The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-generated markdown files and raw notes from the vault to generate digests. These external data sources are untrusted and could contain malicious instructions designed to hijack the agent's reasoning or output during the synthesis process.
Ingestion points: Markdown files (.md) throughout the $OBSIDIAN_VAULT_PATH and files within the _raw/ directory.
Boundary markers: The skill does not specify the use of delimiters or 'ignore' instructions to isolate ingested content from the agent's control flow.
Capability inventory: The skill has the ability to write new markdown files to the vault, modify existing files (like index.md and log.md), and execute shell commands.
Sanitization: There is no evidence of sanitization or escaping of the ingested content before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the qmd utility to update search indices and generate embeddings after writing to the vault. While these commands are local, they represent a capability that could be targeted if the agent is compromised via prompt injection.
Evidence: Execution of ${QMD_CLI:-qmd} update, ${QMD_CLI:-qmd} embed, and ${QMD_CLI:-qmd} ls commands defined in the QMD Refresh section.

wiki-digest