obsidian-paper-vault
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security threats or malicious behaviors were detected in the skill instructions or associated scripts.
- [EXTERNAL_DOWNLOADS]: The skill references the
PyMuPDF(fitz) library, which is a well-known, industry-standard Python library for PDF parsing. It is used for its intended purpose of text extraction. - [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/extract_pdfs.py) to extract text from PDFs. The script uses standard PyMuPDF functions and does not perform network requests or dangerous system operations. - [DATA_EXFILTRATION]: Data operations are restricted to the local file system, specifically the user-defined Obsidian vault and a local cache directory (
~/.local/cache/paper-vault-texts/). No network-based exfiltration patterns were identified. - [PROMPT_INJECTION]: The skill includes 'Anti-Hallucination rules' and strict subagent instructions. These are safety-oriented constraints designed to ensure data integrity and prevent the AI from fabricating information, rather than attempts to bypass platform security guardrails.
Audit Metadata