The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled markdown files which could contain hidden instructions targeting the agent.
Ingestion points: The agent uses read_file and search_files to retrieve note content as described in SKILL.md.
Boundary markers: There are no instructions for the agent to treat note content as untrusted or to use delimiters to separate instructions from data.
Capability inventory: The skill provides the agent with write_file, patch, and terminal tools in SKILL.md, creating a path for malicious instructions in notes to trigger actions.
Sanitization: No sanitization or validation of note content is mentioned to prevent command injection or other malicious sequences.

obsidian