The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute multiple local scripts using python3 (e.g., scripts/resolve_route.py, scripts/local_artifact_smoke.py, scripts/validate_artifact_quality.py). As the contents of these scripts are not provided for analysis, their behavior cannot be verified, posing a significant risk of arbitrary code execution on the host system.\n- [COMMAND_EXECUTION]: Uses osascript (AppleScript) to automate GUI actions within Obsidian. While intended for PDF export, GUI automation provides a mechanism to interact with the host OS and other applications without user oversight.\n- [REMOTE_CODE_EXECUTION]: The skill attempts to modify the agent's Model Context Protocol (MCP) configuration using od mcp install. Modifying the internal configuration of the agent can persist malicious behavior and change how the agent interacts with other tools and user data.\n- [EXTERNAL_DOWNLOADS]: The skill installs third-party packages from PyPI (notebooklm-py) and clones repositories from GitHub (open-design). These resources originate from non-trusted maintainers (teng-lin, nexu-io) and are executed with local system permissions.\n- [PROMPT_INJECTION]: The skill processes untrusted data from URLs and Markdown files to generate conversion prompts for other models (e.g., Codex, NotebookLM). This creates a surface for indirect prompt injection.\n
Ingestion points: External Markdown files and processed URL content via soia-pkm-clip-*.\n
Boundary markers: Absent. The prompt templates interpolate variables directly without using delimiters or instructions to ignore embedded commands.\n
Capability inventory: Subprocess execution, file system modification, and network access.\n
Sanitization: Absent. There is no evidence of filtering or validation of external content before it is processed by the AI.

soia-pkm-transform-obsidian-pdf