The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands via the obsidian CLI tool. It directs the agent to interpolate potentially untrusted content (from articles or user input) into command arguments such as content="<完整内容>" or path="00_Inbox/标题.md". If the execution environment or the CLI tool itself does not properly escape these strings, it could lead to arbitrary command injection.
[PROMPT_INJECTION]: The 'Knowledge Capture' workflow described in SKILL.md involves ingesting data from external, untrusted sources such as URLs, articles, and reports. This exposes the agent to indirect prompt injection attacks where malicious instructions embedded in the external content could trick the agent into ignoring its internal rules or performing unauthorized actions.
Ingestion points: Untrusted data enters the context through URLs and article processing via the fetch and read skills as described in the Knowledge Capture section of SKILL.md.
Boundary markers: The skill relies on high-level instructions to respect privacy (e.g., avoiding 02_Privacy/) but does not implement robust boundary markers or delimiters between system instructions and external data.
Capability inventory: The agent has the capability to search, read, create, append, and move files within the file system via the obsidian CLI across all documented scripts.
Sanitization: There is no evidence of content sanitization or validation before external data is processed or written to the vault.

obsidian-knowledge