obsidian
Fail
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: HIGHPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill instructions advise modifying shell profile files (~/.zshrc or ~/.bashrc) to persist the OBSIDIAN_VAULT environment variable (SKILL.md). Modifying these files is a persistence mechanism that can be leveraged to execute code automatically when a new shell session starts.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by reading content from external markdown files. 1. Ingestion points: The skill reads file content using the cat and grep commands via the Bash tool (SKILL.md). 2. Boundary markers: There are no instructions provided to the agent to treat the file content as data rather than instructions, nor are there delimiters to isolate the untrusted input (SKILL.md). 3. Capability inventory: The agent has access to the Bash tool, enabling it to execute arbitrary commands, modify files, and potentially install external packages (SKILL.md). 4. Sanitization: The skill lacks any sanitization or validation mechanisms for the data retrieved from the Obsidian vault notes (SKILL.md).
Recommendations
- AI detected serious security threats
Audit Metadata