The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to bypass sandbox restrictions by requesting escalated permissions. In SKILL.md, it directs the agent to rerun commands with sandbox_permissions: "require_escalated" if access to the ~/.obelisk directory is blocked by standard environment permissions.
[DYNAMIC_EXECUTION]: The skill's core functionality relies on generating arbitrary Javascript files and executing them at runtime. The instructions in SKILL.md and references/api-reference.md guide the agent to write bounded JS queries to temporary .mjs files and then execute them using the obelisk --query CLI tool.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from past Claude, Codex, Kimi, and Pi sessions. This session history constitutes untrusted external data that may contain malicious instructions designed to influence the agent's behavior during retrieval.
Ingestion points: History is retrieved from ~/.obelisk/obelisk.sqlite via the obelisk CLI, processing messages, tool results, and summaries.
Boundary markers: The provided documentation and patterns do not specify the use of clear delimiters or instructions to ignore embedded commands within the retrieved history.
Capability inventory: The skill possesses Write (for query files), Bash (for tool execution), and Read capabilities.
Sanitization: While some helpers use FTS5 tokenization, there is no evidence of robust sanitization or escaping for natural language instructions retrieved from session transcripts.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage its query environment, including mktemp for creating unique script paths and mkdir for directory management as seen in the 'Quick Start' section of SKILL.md.

obelisk