The Agent Skills Directory

[Data Access Surface] (SAFE): The manifest describes functionality to read and search Obsidian vault notes. While this involves accessing sensitive user data, it is the stated primary purpose of the skill. Users should ensure they trust the agent before granting access to private vaults.
[No Executable Code] (SAFE): The provided file is a JSON manifest containing metadata (name, author, version). No scripts, command-line executions, or prompt instructions were provided for analysis as the 'SKILL.md' file referenced in the manifest was not included.
[Indirect Prompt Injection Surface] (LOW): By design, the skill ingests untrusted data from local notes. This creates a surface where an attacker could potentially place malicious instructions in a note to influence the agent. However, without the skill logic, the specific risk cannot be fully assessed.

obsidian-reader