The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill supports the obsidian eval command, which enables the execution of arbitrary JavaScript code within the running Obsidian application. This is a significant risk if the code originates from untrusted sources, such as content retrieved from a note during an automated workflow.
[COMMAND_EXECUTION]: The obsidian dev:cdp command provides access to the Chrome DevTools Protocol, allowing for low-level interaction with the application's renderer process and browser environment. Furthermore, the skill demonstrates the use of shell command substitution (e.g., $(date)) in examples to generate command arguments, which may allow for broader shell-level exploitation.
[EXTERNAL_DOWNLOADS]: Through the obsidian plugin:install command, the skill can download and install third-party plugins from external registries. This capability allows for the introduction of external, potentially malicious code into the user's local environment.
[DATA_EXFILTRATION]: The obsidian dev:screenshot command allows the agent to take screenshots of the Obsidian interface. This presents a risk of sensitive data exposure if the vault content or UI elements containing private information are captured and shared.
[PROMPT_INJECTION]: The skill's architecture is vulnerable to indirect prompt injection. Untrusted data is ingested via obsidian read and obsidian search commands (ingestion points). There are no provided instructions or markers to distinguish note content from the agent's system prompts (boundary markers). The skill possesses dangerous capabilities, including code evaluation and plugin management (capability inventory), and does not specify any sanitization or validation logic for the content it processes (sanitization).

obsidian