ray-obsidian
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
vault_setup.py) to manage the file system. The script uses standard libraries and performs specific, documented actions such as creating folders and copying templates to a user-specified directory. - [INDIRECT_PROMPT_INJECTION]: The skill scans existing directories and files to determine if a vault is compatible. While this constitutes a data ingestion surface, the processing is limited to path existence and JSON manifest parsing, with no instruction following from the processed content. Instructions explicitly forbid moving or modifying user notes.
- [DATA_EXFILTRATION]: No network operations,
curlcommands, or calls to external APIs were found. The skill operates entirely within the local file system scope. - [CREDENTIALS_SAFE]: No hardcoded secrets, API keys, or attempts to access sensitive system locations (such as
.sshor.awsdirectories) were identified. The skill manages its own manifest file (.ray-obsidian.json) to track structure versions.
Audit Metadata