obsidian

SUSPICIOUS. The skill’s purpose and local file access are coherent for Obsidian automation, and there is no sign of credential theft or exfiltration. However, it depends on a third-party CLI installed from a non-official Homebrew tap even though official Obsidian documentation now points to a same-org built-in CLI, making the install trust inconsistent and high risk from a supply-chain perspective.