The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from an Obsidian vault, which could contain malicious instructions.
Ingestion points: Notes, Canvas layouts (.canvas), and Bases definitions (.base) are read and parsed as described in SKILL.md, references/formats.md, and references/markdown.md.
Boundary markers: The skill provides logic to distinguish live links and properties from examples in code or quotations to reduce accidental execution of embedded patterns.
Capability inventory: The skill possesses the ability to read and write files, as well as execute the obsidian CLI command.
Sanitization: The skill enforces a "root-confinement contract" to prevent directory traversal by normalizing paths and rejecting escapes. It also specifically warns about shell injection risks when passing note content as CLI arguments.
[COMMAND_EXECUTION]: The skill utilizes the obsidian CLI adapter for app-aware operations.
Evidence: references/cli.md provides instructions for executing obsidian vault=... read path=... and other commands.
Mitigation: The skill provides explicit instructions to avoid shell escaping issues by using structured process arguments and warns against using the CLI for transport of complex text if safety cannot be guaranteed.

x9-obsidian