The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a runtime formula engine described in SKILL.md and references/FUNCTIONS_REFERENCE.md. The engine includes an html() function that renders strings directly into the UI. This creates a significant surface for Cross-Site Scripting (XSS) if the agent uses this function to display property values from notes that contain malicious scripts.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external notes in an Obsidian vault, which are untrusted sources.
Ingestion points: Note metadata and frontmatter properties are accessed via file.properties, file.tags, and file.path as defined in SKILL.md.
Boundary markers: The instructions do not define any delimiters or system instructions to prevent the agent from being influenced by instructions embedded within the processed note data.
Capability inventory: The skill allows writing .base configuration files to the filesystem and executing logic through the formula engine, including UI rendering via the html() function.
Sanitization: While escapeHTML() is documented in references/FUNCTIONS_REFERENCE.md, the skill workflow in SKILL.md does not provide instructions or enforcement for the agent to sanitize note data before interpolation into formulas or views.

obsidian-bases