obsidian-canvas
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.run()inscripts/grade_canvas.pyto execute a local validation script (scripts/validate_canvas.py). This is a benign use for automated testing and validation of generated canvas files. - [COMMAND_EXECUTION]:
SKILL.mdsuggests using theobsidian opencommand to open created files. This is standard functionality for Obsidian users and requires the Obsidian CLI to be present on the system. - [EXTERNAL_DOWNLOADS]: The skill references
https://jsoncanvas.org/andhttps://example.comin documentation and examples. These are informational and do not involve downloading or executing remote code. - [SAFE]: The evaluation framework and scripts are used for testing purposes and operate on local files provided by the user or generated during the evaluation flow.
Audit Metadata