The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing the obsidian CLI tool to perform all actions, which involves spawning subprocesses with complex parameters provided by the agent.
[REMOTE_CODE_EXECUTION]: Includes the obsidian eval command, which allows for the execution of arbitrary JavaScript within the context of the Obsidian application. This capability could be leveraged to perform unauthorized actions or gain further access to the host system through the Electron application environment.
[DATA_EXFILTRATION]: Provides the ability to read and search the entire contents of an Obsidian vault, which typically contains sensitive personal or professional information. Additional commands like obsidian dev:screenshot and obsidian dev:dom allow for the extraction of visual and structural data from the running application.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection.
Ingestion points: Data is ingested via obsidian read and obsidian search commands in SKILL.md.
Boundary markers: No boundary markers or instructions to ignore embedded commands are present in the prompt templates.
Capability inventory: The agent has access to obsidian eval, obsidian create, and UI inspection tools, which could be abused if malicious instructions are encountered in a vault note.
Sanitization: No sanitization or validation of vault content is performed before processing.
[METADATA_POISONING]: The skill references https://help.obsidian.md/cli as its official documentation source. This URL appears to be deceptive as the official Obsidian documentation does not currently host a CLI reference at that specific path, potentially misleading users about the tool's provenance and safety.

obsidian-cli