The Agent Skills Directory

[SAFE]: The skill uses local Node.js scripts (shapes.js, write-to-vault.js) to generate and manage Excalidraw JSON files. No external network requests or remote script executions are performed. The scripts use built-in Node.js modules and have no external dependencies.\n- [COMMAND_EXECUTION]: The skill invokes the local obsidian CLI via child_process.spawnSync. This is used to bypass filesystem permissions on iCloud-synced vaults. The arguments are passed as an array, which is a secure method that prevents command injection vulnerabilities.\n- [DATA_EXFILTRATION]: While the skill interacts with vault paths, including sensitive directories like ~/Library/Mobile Documents/, this access is necessary for its core functionality and no data exfiltration via network calls was detected. The script write-to-vault.js verifies integrity by reading back the file contents after writing, which is a safe operational practice.\n- [PROMPT_INJECTION]: Instructions focus on technical diagram generation and do not contain patterns intended to bypass AI safety guardrails or override system instructions.

obsidian-excalidraw