The Agent Skills Directory

PROMPT_INJECTION (LOW): The skill is susceptible to indirect prompt injection (Category 8) because it ingests and analyzes user-controlled content from an Obsidian vault. Malicious instructions placed in markdown files could influence the agent's logic during processing.
Ingestion points: examples/lsp_backlink_analysis.py uses vault_path.glob("**/*.md") to read all markdown files within the target vault.
Boundary markers: No explicit delimiters or safety warnings are present to distinguish between data and instructions during processing.
Capability inventory: The skill can modify vault files via frontmatter_processor.py and write analysis reports to disk as seen in examples/lsp_backlink_analysis.py.
Sanitization: No sanitization of the markdown content is performed before analysis or reporting.
EXTERNAL_DOWNLOADS (LOW): The setup guide in docs/LSP_QUICKSTART.md instructs users to install markdown-oxide via cargo install. While this is necessary for the skill's primary purpose, it involves downloading and executing a third-party binary from an external source (crates.io).

obsidian-process