save
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-selected answers, decisions, and tool outputs that could contain malicious instructions.
- Ingestion points: Processes pasted text, quoted source text, and conversation materials for preservation (SKILL.md).
- Boundary markers: Explicitly instructs the agent to treat these inputs as 'untrusted content-to-preserve' and to ignore any embedded directives (SKILL.md).
- Capability inventory: Executes vault mutations through a local Python script via subprocess calls (SKILL.md).
- Sanitization: Requires all changes to be drafted and reviewed via a transaction bundle before being applied to the vault (SKILL.md).
- [COMMAND_EXECUTION]: The skill executes a local Python script (
claude-obsidian.py) to manage vault transactions. - Evidence: The skill uses
python3 "$CORE" workflow inspectandpython3 "$CORE" workflow applyto process save operations (SKILL.md). The path to the script is resolved from the skill's own installation directory, minimizing the risk of arbitrary code execution.
Audit Metadata