The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill exposes the obsidian eval command, which allows the execution of arbitrary JavaScript code within the context of the running Obsidian application.
Evidence: obsidian eval code="app.vault.getFiles().length" in SKILL.md.
[DYNAMIC_EXECUTION]: The skill provides access to the Chrome DevTools Protocol via the dev:cdp and dev:debug commands, enabling low-level interaction and potential exploitation of the application's internal state.
Evidence: obsidian dev:cdp method="Page.captureScreenshot" params='{"format":"png"}' and obsidian dev:debug on in SKILL.md.
[EXTERNAL_DOWNLOADS]: The documentation instructs users to install a global Node.js package from a public registry that is not part of the standard Obsidian distribution.
Evidence: npm install -g obsidian-headless in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it is designed to ingest and process vault content (notes, tasks, properties) which may contain malicious instructions.
Ingestion points: Commands such as obsidian read, obsidian search, obsidian tasks, and obsidian history:read ingest untrusted file content into the agent's context.
Boundary markers: There are no instructions for the agent to use XML tags or specific delimiters to isolate content from these notes.
Capability inventory: The skill has extensive write and execution capabilities, including obsidian create, obsidian eval, obsidian dev:cdp, and obsidian plugin:install.
Sanitization: The skill does not define any sanitization or validation logic for the content retrieved from the vault before it is processed or used in subsequent commands.
[COMMAND_EXECUTION]: The skill relies on shell command execution to interface with the Obsidian binary, including passing user-provided content (e.g., note text, property values) directly into CLI parameters.
[CREDENTIALS_UNSAFE]: The skill provides instructions for managing sensitive authentication tokens for the headless sync feature, which could be exposed if not handled carefully by the agent.
Evidence: export OBSIDIAN_AUTH_TOKEN="your-token" in SKILL.md.

obsidian-cli