obsidian-bases
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It instructs the agent to ingest data from Obsidian notes (via tags, folders, and properties) to define filters and formulas in the generated .base files.
- Ingestion points: Data is pulled from any note in the vault matching specific criteria in the .base file configuration.
- Boundary markers: The instructions do not specify any delimiters or safety warnings for the agent to ignore instructions embedded within the notes it processes.
- Capability inventory: The agent can write to the filesystem (creating/editing .base files) and generate logic using a formula language that includes HTML rendering capabilities (html() function in references/FUNCTIONS_REFERENCE.md).
- Sanitization: No sanitization or validation steps are provided for the content extracted from notes before it is interpolated into the YAML schema of the .base file.
Audit Metadata