obsidian-hardened

SUSPICIOUS. The skill’s note-management purpose is coherent, and its guardrails are privacy-conscious, but the install path is not internally consistent: it points users to a third-party Yakitrak CLI while implying official Obsidian alignment via the homepage and branding. Because the skill depends on an external non-official binary to access private notes and modify vault contents, the supply-chain risk is high even without evidence of active exfiltration.