The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted content from the user's Obsidian vault.
Ingestion points: Source material is read from various vault locations (e.g., Inbox) and processed during Phase 1 (Score) and Phase 4 (Execute).
Boundary markers: The skill lacks explicit boundary markers (such as XML tags or unique delimiters) to wrap ingested content, which could allow malicious instructions within a note to influence agent behavior.
Capability inventory: The skill has the ability to write and replace notes using the obsidian_write_note and obsidian_replace_in_note tools.
Sanitization: There is no evidence of sanitization or filtering performed on the source material before it is interpolated into the prompt context.
[SAFE]: The skill instructions include robust procedural constraints, such as mandatory user confirmation before any write operations and a strict scoring system, which serve as functional security layers.
[SAFE]: The shell scripts validators/pre-check.sh and validators/post-check.sh are benign utility scripts used for ensuring output structure during development and testing.
[SAFE]: No obfuscated content, hardcoded credentials, or unauthorized network operations were identified within the skill's files.

note-promotion