The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses child_process.exec to run system commands such as du and powershell. It interpolates the vault's base path into these command strings without sufficient escaping, which could allow for command injection if a vault is located in a directory with a malicious name.
[PROMPT_INJECTION]: The logic for finding orphaned attachments reads the full text of all markdown files within the vault. This data is untrusted and could contain hidden instructions designed to manipulate the agent's behavior during the audit.
Ingestion points: SKILL.md (Phase 1) performs app.vault.cachedRead(file) on markdown files.
Boundary markers: Content is ingested without delimiters or specific instructions to ignore embedded commands.
Capability inventory: The skill can execute shell commands, read/write local configuration files, and rename files within the vault.
Sanitization: There is no sanitization or validation of the content read from the files before processing.
[COMMAND_EXECUTION]: The skill makes extensive use of sensitive Node.js modules like fs and child_process to read and modify the environment, representing a broad permission set that could be exploited if the agent is compromised.

obsidian-performance