The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to read and reason over untrusted content from an Obsidian vault (e.g., in assets/modes/READ.md).
Ingestion points: The skill ingests untrusted data via the Read and Grep tools when searching or reading notes (e.g., READ_NOTE, SEARCH_TEXT operations).
Boundary markers: The skill includes mitigation instructions in assets/modes/READ.md (Rule 1) to quote relevant passages and distinguish between note content and the agent's interpretation.
Capability inventory: The skill has access to Bash, Write, and Edit, allowing it to modify files or execute shell commands based on its analysis.
Sanitization: No explicit sanitization of ingested note content is performed before processing.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform vault operations such as directory creation, file moving, and deletion (e.g., assets/modes/SYNC.md). These commands use string interpolation of paths (e.g., rm '{vault_path}/{file_path}'), which could potentially be manipulated if note metadata or user-provided paths contain shell-sensitive characters, although the use of single quotes provides a basic layer of protection.

obsidian