The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and obey instructions from AGENTS.md or CLAUDE.md files found within the user's Obsidian vaults. These instructions are explicitly allowed to override the skill's default behavior. This creates a surface for indirect prompt injection where a malicious file placed in a vault could manipulate how the agent processes and stores information.
Evidence Chain:
Ingestion points: The agent reads the content of AGENTS.md or CLAUDE.md located at the vault root (SKILL.md).
Boundary markers: Absent. The instructions state these rules "override every default."
Capability inventory: The skill has filesystem read access (finding vaults and reading rules) and write access (writing/appending notes to the vault).
Sanitization: Absent. The rules are followed as instructions to govern the placement and formatting of notes.
[COMMAND_EXECUTION]: The skill invokes a local Python script scripts/find_vaults.py to identify Obsidian vault locations. The script performs a directory traversal of the user's home directory (HOME) up to a depth of 4 levels. While this is used for the stated purpose of finding vaults, it represents a programmatic scan of the user's filesystem structure.

to-note