The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-generated content from an Obsidian vault to perform daily planning, inbox organization, and project reviews. This data ingestion surface is vulnerable to indirect prompt injection if notes contain malicious instructions that the agent might inadvertently follow.
Ingestion points: The agent reads all files within the user-specified vault path, specifically scanning 01-Projects/, 02-Areas/, and 00-Inbox/ folders.
Boundary markers: The instructions do not define delimiters or specific "ignore embedded instructions" warnings for the content read from the vault.
Capability inventory: The agent possesses extensive file system capabilities (read, write, edit, create directory) and shell access via bash (in Claude Code environments), which could be misused if an injection is successful.
Sanitization: There are no instructions for the agent to sanitize, escape, or validate the content of the notes before interpreting them for planning or organizational tasks.

second-brain