The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and interpret data from the user's Obsidian vault (e.g., notes, PARA structure, and a configuration file named AGENTS.md), which serves as a vector for indirect prompt injection if those files contain malicious instructions.
Ingestion points: Reads the vault-root AGENTS.md to interpret paths, ownership, and workflows, and inspects folders and note content during operations (SKILL.md).
Boundary markers: Instructs the agent to derive LLM-managed and human-managed boundaries from AGENTS.md and treat specific directories as read-only (SKILL.md).
Capability inventory: Performs file-writes, named-section updates, and executes shell commands via the obsidian CLI (SKILL.md).
Sanitization: Includes a security directive to treat generated markdown as data rather than shell code and explicitly forbids placing user-generated content inside executable shell command strings (SKILL.md).
[COMMAND_EXECUTION]: The skill utilizes a local command-line interface (CLI) to perform vault operations.
Evidence: Instructions direct the agent to "Use the Obsidian CLI for discovery, navigation, metadata, moves, and other commands" and to run obsidian help for syntax verification (SKILL.md).

vault