The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to interact with the host system using the Bash tool to run the obelisk CLI for indexing and querying history.
[DYNAMIC_EXECUTION]: The skill employs a dynamic execution pattern where it writes JavaScript code to temporary .mjs files and then executes them via the obelisk --query command. The documentation explicitly warns that these scripts run with the privileges of the CLI process and are not sandboxed.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from historical session logs and memories. This content could contain malicious instructions from previous interactions that could be reactivated when retrieved.
Ingestion points: Data is pulled from the ~/.obelisk/obelisk.sqlite database using several retrieval helpers (search, messages, memories, summaries).
Boundary markers: The skill does not define or use explicit delimiters or "ignore embedded instructions" warnings when presenting retrieved history to the agent.
Capability inventory: The skill possesses Read and Bash capabilities (restricted to the obelisk CLI).
Sanitization: No sanitization, validation, or escaping of retrieved historical text is documented or implemented in the provided query patterns.
[DATA_EXPOSURE]: The skill facilitates access to sensitive local information, including full conversation transcripts, tool inputs/outputs, and project-specific metadata stored by various coding agents.
[PRIVILEGE_ESCALATION]: In SKILL.md, the agent is instructed to request escalated permissions (sandbox_permissions: "require_escalated") if it encounters permission errors (SQLITE_READONLY, EACCES) while attempting to write to the Obelisk storage directory.

obelisk