obsidian-bases
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a schema for processing external, potentially untrusted data from an Obsidian vault (note metadata and content).
- Ingestion points: Note frontmatter properties and file system metadata (e.g., file.name, file.size) as described in SKILL.md.
- Boundary markers: There are no explicit delimiters defined to separate user-provided note data from the agent's instructions within the YAML structure.
- Capability inventory: The skill enables the creation of .base files which can perform logic and render content, including HTML via the documented html() function.
- Sanitization: The instructions explicitly include an escapeHTML() function, documenting best practices for mitigating injection risks.
Audit Metadata