The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation guide in SKILL.md and README.md recommends piping a remote shell script directly into the shell: curl -fsSL https://raw.githubusercontent.com/tommy0103/obelisk/main/install.sh | sh. While the source is the author's own repository, this is a high-risk pattern for executing unverifiable code.
[PRIVILEGE_ESCALATION]: The skill instructions in skill-doc/SKILL.md explicitly direct the agent to request escalated permissions (sandbox_permissions: "require_escalated") if it encounters SQLITE_READONLY or EACCES errors when writing to ~/.obelisk. This is an intentional attempt to bypass environmental security constraints and sandbox restrictions.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to index and query transcripts from various AI agents (Claude, DeepSeek, Codex). As noted in the project's own CONTRIBUTING.md, this content is 'attacker-controlled'. A malicious payload inside a previously indexed session log could attempt to influence the behavior of the agent currently performing retrieval.
Ingestion points: packages/core/src/providers/*.ts (reads JSONL/SQLite logs from various agent history directories).
Boundary markers: Absent. The agent is instructed to treat results as context for answering user queries.
Capability inventory: The agent uses the Bash tool to execute obelisk --query, which runs a JavaScript sandbox that can perform SQLite queries.
Sanitization: While the app performs some escaping for rendering, the agent receives structured JSON results from the CLI which contain the raw indexed text.
[EXTERNAL_DOWNLOADS]: The skill downloads external assets and code during setup (via curl) and for app updates (using Sparkle and electron-updater). These targets include GitHub and CDNs like jsDelivr for the 'marked' library.

obelisk-installer