The Agent Skills Directory

Prompt Injection (LOW): The skill is susceptible to Indirect Prompt Injection.
Ingestion points: io_utils.py reads content from files (Markdown, Text, PDF, DOCX, and OCR from images) located in the user's inbox folder.
Boundary markers: Absent. The function build_user_prompt in disassembler.py appends the raw file content directly to the prompt without any delimiters or 'ignore embedded instructions' warnings.
Capability inventory: The system writes files to the local disk and archives source files based on the LLM's output. An attacker could craft a file in the inbox to redirect writing to arbitrary categories or inject malicious content.
Sanitization: No sanitization is performed on the file content before it is sent to the LLM.
Dynamic Execution (MEDIUM): The file engine/validator.py uses ast.literal_eval within the dirty_json_clean function to parse the LLM's output if standard JSON parsing fails. While safer than eval(), using a Python literal evaluator on untrusted data from an LLM is a dynamic execution risk and can be used for denial-of-service or logic bypass if the model is manipulated.
Data Exposure & Exfiltration (LOW): The skill's primary function involves reading the entire contents of files in the inbox and sending them to an external endpoint (OPENAI_BASE_URL). While this is the intended behavior, users should be aware that all processed data is transmitted to the configured API provider.
Unverifiable Dependencies (LOW): The skill relies on paddleocr for image processing (mentioned in io_utils.py and the README.md), but this package is not locked to a specific version in requirements.txt.
Missing Files: The core logic file engine/pipeline.py referenced in main.py was not provided in the source files, limiting the audit's visibility into the final file-writing and archiving logic.

obsidian-knowledge-factory