obsidian-wiki-runtime
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a central path validation utility (
ensure_within) across all modules. This function resolves absolute paths and verifies they are children of the designated vault or control center root, effectively preventing directory traversal attacks. - [SAFE]: The 'Obsidian Wiki Doctor' functionality includes an proactive security scanner that uses regular expressions to identify potential exposure of passwords, API tokens, private keys, and internal connection strings within the vault's Markdown files.
- [SAFE]: All filesystem modifications employ atomic writing patterns (using temporary files and
os.replace) and a structured locking mechanism (VaultLock) to ensure data consistency and prevent race conditions. - [SAFE]: The skill processes untrusted user data in the form of Markdown files but restricts its modifications to specific 'managed' and 'projection' regions delimited by unique boundary markers, which are validated against checksums stored in the wiki's internal registry.
Audit Metadata