obsidian-canvas

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run() in scripts/grade_canvas.py to execute a local validation script (scripts/validate_canvas.py). This is a benign use for automated testing and validation of generated canvas files.
  • [COMMAND_EXECUTION]: SKILL.md suggests using the obsidian open command to open created files. This is standard functionality for Obsidian users and requires the Obsidian CLI to be present on the system.
  • [EXTERNAL_DOWNLOADS]: The skill references https://jsoncanvas.org/ and https://example.com in documentation and examples. These are informational and do not involve downloading or executing remote code.
  • [SAFE]: The evaluation framework and scripts are used for testing purposes and operate on local files provided by the user or generated during the evaluation flow.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 06:41 PM
Security Audit — agent-trust-hub — obsidian-canvas