obsidian-brain
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the ingestion of untrusted data from the Obsidian vault's human zone.
- Ingestion points: Project notes, daily journals, and task files are read into context via the /context and /today commands, and linked notes are retrieved through the query-links.sh script.
- Boundary markers: The skill does not provide clear delimiters or instructions to the agent to treat note content as potentially untrusted or to ignore instructions embedded within the notes.
- Capability inventory: The skill possesses the ability to execute local bash scripts, read any file within the vault, and write content to the vault's AI zone (ops/) using safe-write.sh.
- Sanitization: There is no evidence of sanitization or escaping of the Markdown content before it is processed by the AI agent.
- [COMMAND_EXECUTION]: The skill relies on local shell scripts to perform vault management and search operations.
- Evidence: The scripts init-vault.sh, capture.sh, and query-links.sh are used to initialize the filesystem, write notes, and execute search tools like ripgrep (rg) to analyze note connections. Path validation in safe-write.sh is used to restrict the agent's write access to the AI zone.
Audit Metadata