The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The tool obsidian_eval allows for arbitrary JavaScript execution within the Obsidian application context. Evidence is found in SKILL.md and knowledge/cdp-protocol.md. This capability allows for the reading, modification, and potential deletion of user data within the vault via the app.vault API.
REMOTE_CODE_EXECUTION (HIGH): The skill architecture is built on the Chrome DevTools Protocol (CDP) to execute logic remotely. Evidence in knowledge/cdp-protocol.md and knowledge/sdk-reference.md confirms the use of Runtime.evaluate to execute instructions sent from the agent.
PROMPT_INJECTION (HIGH): The skill possesses a high risk of indirect prompt injection due to its design to process untrusted data. Evidence:
Ingestion points: Vault content is read via app.vault.read() (knowledge/api-basics.md) and sdk.read_file() (knowledge/sdk-reference.md).
Boundary markers: None are present in instructions to distinguish vault data from instructions.
Capability inventory: Access to obsidian_eval, app.vault.modify, app.vault.create, and obsidian_update_frontmatter across multiple files provides high-privilege write and execute functions.
Sanitization: No evidence of sanitizing or escaping external markdown content before it is processed by the agent.
DATA_EXFILTRATION (MEDIUM): The combination of vault-wide read access (app.vault.getFiles) and the availability of standard browser APIs (such as fetch) within the Obsidian context enables the potential exfiltration of sensitive personal knowledge base data.

obsidian-developer