The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to read personal information from the user's Obsidian vault located at /Users/rami/Library/Mobile Documents/iCloud~md~obsidian/Documents/Obsidian. It copies this content to /private/tmp/intent-calendar-context, a globally readable directory on many systems, which may expose sensitive user data to other processes.
[PRIVILEGE_ESCALATION]: The scripts/stage_obsidian_context.sh script utilizes osascript to automate the macOS Finder application to duplicate files. This technique is used to circumvent Transparency, Consent, and Control (TCC) file access restrictions that would normally block the AI agent's direct access to sensitive iCloud-synced folders.
[COMMAND_EXECUTION]: The skill executes shell commands and scripts, including osascript for Finder automation and the gws (Google Workspace) utility for managing calendar events.
[INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted data from the Obsidian vault and using it to drive automated actions in Google Calendar. Ingestion points: Files are staged from the user's Obsidian vault via scripts/stage_obsidian_context.sh. Boundary markers: The SKILL.md file contains instructions to treat the skill's rules as primary, but no robust technical boundaries are present to prevent instructions embedded in vault notes from influencing the agent. Capability inventory: The skill uses the gws tool to perform write operations, including inserting, patching, and deleting Google Calendar events. Sanitization: No sanitization or validation of the content read from the vault is performed before it is used by the agent to make planning decisions.

intent-calendar-planner