The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interacts with the user's environment by executing the obsidian CLI to manage notes. This is used to bypass filesystem restrictions on iCloud-synced vaults. The implementation uses spawnSync with argument arrays, which is a secure pattern that prevents command injection.
[DYNAMIC_EXECUTION]: The write-to-vault.js script employs a synchronous sleep mechanism by executing a static, benign JavaScript snippet using node -e. This is a controlled use of dynamic execution for a specific utility purpose.
[INDIRECT_PROMPT_INJECTION]: The skill contains logic to read and verify notes from the Obsidian vault. This ingestion of external data is a known attack surface; however, the skill mitigates risk by performing strict validation using JSON.parse on the retrieved content.

obsidian-excalidraw