obsidian-web-clipper
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates entirely within the context of generating static JSON configuration files for the Obsidian Web Clipper extension. It does not perform any network operations, file system modifications outside of the intended vault template structure, or execution of arbitrary code.
- [PROMPT_INJECTION]: No prompt injection or behavior override patterns were detected. The instructions focus on structured data extraction and vault organization.
- [CREDENTIALS_UNSAFE]: The skill explicitly warns users about the security risks of leaking interpreter API keys in full settings exports and provides guidance on avoiding this (found in
SKILL.mdandreferences/gotchas.md). It does not request or store any credentials itself. - [DATA_EXFILTRATION]: There are no patterns suggesting data exfiltration. The skill defines template structures for the user's local Obsidian vault.
- [EXTERNAL_DOWNLOADS]: The skill refers to official documentation and repositories (e.g.,
obsidianmd/obsidian-clipper) for reference purposes only, which is consistent with the [TRUST-SCOPE-RULE] for well-known services. - [REMOTE_CODE_EXECUTION]: No remote code execution patterns were found. The 'Interpreter' functionality mentioned refers to Obsidian's native LLM-powered extraction, which is managed by the user's local extension and API keys.
Audit Metadata