save
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script located at a predefined product root to handle vault transactions. Evidence found in the 'Prepare' and 'Preview and apply' sections of SKILL.md.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and archive untrusted content from user conversations. It includes explicit defensive instructions to ensure the agent does not follow instructions hidden within the saved data.
- Ingestion points: User-selected answers, decisions, and chat insights (SKILL.md).
- Boundary markers: The skill explicitly instructs the agent to treat data as 'untrusted content-to-preserve' and ignore any embedded directives to run commands or change scope (SKILL.md).
- Capability inventory: File system access to the Obsidian vault through the execution of the claude-obsidian.py script (SKILL.md).
- Sanitization: The skill relies on natural language instructions to filter and ignore nested directives rather than using programmatic escaping.
Audit Metadata