ray-obsidian

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script (vault_setup.py) to manage the file system. The script uses standard libraries and performs specific, documented actions such as creating folders and copying templates to a user-specified directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill scans existing directories and files to determine if a vault is compatible. While this constitutes a data ingestion surface, the processing is limited to path existence and JSON manifest parsing, with no instruction following from the processed content. Instructions explicitly forbid moving or modifying user notes.
  • [DATA_EXFILTRATION]: No network operations, curl commands, or calls to external APIs were found. The skill operates entirely within the local file system scope.
  • [CREDENTIALS_SAFE]: No hardcoded secrets, API keys, or attempts to access sensitive system locations (such as .ssh or .aws directories) were identified. The skill manages its own manifest file (.ray-obsidian.json) to track structure versions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 12:17 PM