The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Obsidian vaults, which can contain malicious instructions intended to influence the agent's behavior.
Ingestion points: Note content is retrieved from the filesystem using the obsidian read and obsidian search commands as documented in SKILL.md and references/obsidian-cli-reference.md.
Boundary markers: No delimiters or protective instructions are used to separate note content from agent instructions.
Capability inventory: The skill possesses file-system modification capabilities, including creating (create), moving (move), and appending to (append) notes, as well as executing local scripts.
Sanitization: Content retrieved from vault notes is not sanitized or validated before being processed in the agent's context.
[COMMAND_EXECUTION]: The skill executes a local binary and a custom script to manage vault files.
The scripts/write-markdown-to-vault.js script invokes child_process.spawnSync to run the obsidian binary.
User-provided data and note content are passed as arguments to this binary, which could lead to argument injection if the underlying binary handles certain characters unsafely.
[PRIVILEGE_ESCALATION]: The instructions explicitly request a bypass of standard security constraints.
SKILL.md and the reference documentation instruct the user to run the skill "unsandboxed" to ensure the CLI can communicate with the Obsidian app via a local socket.
Bypassing the command sandbox increases the potential impact of any command injection or malicious script behavior by granting broader access to the host environment.

obsidian-vault-manager