The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on an external CLI tool named obsidian and uses the macOS open command to launch applications and manage the environment.
[REMOTE_CODE_EXECUTION]: The obsidian eval command accepts a code parameter that allows for the execution of arbitrary JavaScript within the context of the running Obsidian application. This provides a direct path for arbitrary code execution if the input is influenced by untrusted data.
[DATA_EXFILTRATION]: The skill exposes multiple interfaces for accessing sensitive user data, including reading note content (obsidian read), searching the vault (obsidian search), taking application screenshots (obsidian dev:screenshot), and extracting text from the DOM (obsidian dev:dom).
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection.
Ingestion points: The skill reads untrusted data from the user's Obsidian vault via obsidian read, obsidian search, and app state inspection commands like obsidian dev:console and obsidian dev:dom (SKILL.md).
Boundary markers: There are no markers or instructions to treat data from the vault as untrusted or to ignore embedded instructions (SKILL.md).
Capability inventory: The skill possesses dangerous capabilities including writing/appending to files (obsidian create, obsidian append) and executing arbitrary JavaScript (obsidian eval) (SKILL.md).
Sanitization: There is no evidence of sanitization or validation performed on data retrieved from the vault before it is used in further commands (SKILL.md).

obsidian