obsidian
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents the
obsidian evalcommand, which permits the execution of arbitrary JavaScript within the running Obsidian application environment. While intended for developer workflows and automation, this capability allows for dynamic code execution at runtime. - [COMMAND_EXECUTION]: The skill utilizes the
obsidiancommand-line interface to interact with vaults, enabling actions such as reading/writing notes, searching vault content, and performing developer tasks like capturing screenshots and inspecting the application's DOM. - [EXTERNAL_DOWNLOADS]: The instructions recommend installing the
mcp-obsidian-clitool usingnpmornpxto provide an Model Context Protocol (MCP) server interface, facilitating the agent's interaction with the Obsidian vault. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from Obsidian notes, which acts as an untrusted data source that could influence agent behavior.
- Ingestion points: Note content is retrieved via
obsidian read,obsidian search, andobsidian daily:readcommands in thereferences/obsidian-cli.mdfile. - Boundary markers: No specific delimiters or "ignore instructions" markers are defined for the ingested content.
- Capability inventory: The skill possesses file system modification capabilities (
create,append,property:set) and application-level JavaScript execution (eval) as documented inreferences/obsidian-cli.md. - Sanitization: No specific content sanitization, escaping, or validation logic is implemented for the processed data.
Audit Metadata