The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documents the obsidian eval command in SKILL.md, which allows the execution of arbitrary JavaScript code within the context of the running Obsidian application. This feature can be exploited to run malicious scripts if an agent is influenced by untrusted input.
[COMMAND_EXECUTION]: The instructions empower the agent to use obsidian and notesmd-cli binaries for comprehensive file system operations including creating, moving, and deleting files within the user's local vault.
[DATA_EXFILTRATION]: Developer commands documented in SKILL.md, specifically obsidian dev:screenshot and obsidian dev:dom, provide mechanisms to capture visual state and UI content from the application, potentially exposing sensitive information.
[PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection due to its core function of reading and searching user-generated vault content.
Ingestion points: Files SKILL.md (via read and search commands) and notesmd-fallback.md (via print and search-content commands) facilitate the ingestion of untrusted data from notes.
Boundary markers: The instructions lack explicit boundary markers or directives to ignore instructions embedded within the notes being processed.
Capability inventory: The agent has access to arbitrary JavaScript execution (obsidian eval), file system manipulation (create, delete), and UI data capture (dev:screenshot).
Sanitization: There are no documented procedures for sanitizing or validating note content before it is processed by the agent.

obsidian-clis