The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of a host-installed obsidian CLI tool to interact with the user's filesystem and running applications. It supports various commands for file operations, task management, and system inspection.
[DYNAMIC_EXECUTION]: The skill includes the obsidian eval command, which allows the agent to execute arbitrary JavaScript code (code="...") within the execution context of the running Obsidian application. This is a high-risk capability as it can be used to bypass typical sandbox restrictions or perform actions on behalf of the user within the app.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect prompt injection:
Ingestion points: The agent reads untrusted data from the vault using obsidian read, obsidian search, and obsidian dev:dom (which extracts text from the application's UI).
Boundary markers: No explicit markers or warnings are provided to help the agent distinguish between its instructions and the content of the notes it reads.
Capability inventory: The agent can write to the filesystem, execute arbitrary code via eval, and take screenshots, providing multiple exploitation paths if it follows instructions embedded within a note.
Sanitization: There is no mention of sanitizing or escaping the content retrieved from the vault before processing it.
[DATA_EXFILTRATION]: The obsidian dev:screenshot command allows the agent to capture the visual state of the workspace and save it to a path (path=screenshot.png). This could be used to capture and potentially exfiltrate sensitive information visible in the Obsidian UI that is not easily accessible via text-based commands.

obsidian-cli