obsidian-vault

SUSPICIOUS: The skill’s capabilities mostly match its stated purpose of managing an Obsidian vault, and data stays local rather than flowing to external services. The main issue is a plaintext embedded API key plus broad vault read/write/delete access and filesystem fallback, which creates meaningful credential-exposure and privacy risk even without signs of malware or external exfiltration.