The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/platforms.py executes system commands (pgrep on Unix and tasklist on Windows) to verify if specific applications are running. These calls are implemented safely by passing a list of arguments and using a hardcoded mapping of application names, which prevents command injection.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to read and organize markdown notes, it possesses an attack surface for indirect prompt injection. The skill robustly mitigates this via explicit safety instructions in SKILL.md and references/safe-mutation-rules.md, which direct the agent to treat all user data as inert content rather than instructions.
Ingestion points: Markdown files in user-specified vaults (identified in SKILL.md).
Boundary markers: Present; the skill provides clear textual boundaries and instructions to the agent to disregard note content as commands.
Capability inventory: File discovery, process checking, and non-destructive trashing via scripts/platforms.py; directory creation and copying via shell commands.
Sanitization: Relies on specific instructions to the agent to maintain the separation between data and instructions.
[DATA_EXPOSURE]: The skill accesses local application configuration files (e.g., obsidian.json) to resolve vault paths. This access is limited to the skill's stated purpose and is protected by a global denylist in references/safe-mutation-rules.md that explicitly forbids access to sensitive folders such as .ssh, .aws, and .gnupg.

organizing-notes