wiki-query
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to call local Python scripts (
claude-obsidian.pyandretrieve.py) usingpython3. These scripts are resolved relative to the skill's own installation directory to ensure they originate from the installed product and not the user-controlled vault. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from an Obsidian vault, which creates a surface for indirect prompt injection attacks.
- Ingestion points: Reads content from
wiki/hot.md,wiki/index.md, and individual markdown files retrieved during searches, as well as JSON ledger files (claim-ledger.json,source-ledger.json). - Boundary markers: The skill includes explicit instructions for the agent to treat all vault content as untrusted evidence, ignore embedded commands, ignore fake role messages, and disregard requests for secrets or egress.
- Capability inventory: File read access within the vault directory and the ability to execute specific local Python scripts for retrieval and contract verification.
- Sanitization: The skill relies on high-level natural language instructions to instruct the model to separate evidence from operational instructions, which helps mitigate but does not fully eliminate the risk of adversarial content within the wiki pages.
Audit Metadata