obsidian-automation

SUSPICIOUS: the skill's purpose is coherent, and its data flows stay local, but its primary install guidance is misaligned with Obsidian's official current CLI and relies on a third-party community tool that receives an API key. This looks more like outdated or trust-loose tooling guidance than malware, but the install provenance and credential forwarding make it medium risk.