obsidian-vault-setup
Warn
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements a workflow that captures arbitrary free-text input from the user and interpolates it directly into several persistent instruction files, including 'CLAUDE.md' and multiple 'SKILL.md' files. This lacks sanitization or boundary markers, creating a surface for indirect prompt injection where malicious user input could influence or override agent behavior in the newly created vault skills.
- Ingestion points: User free-text answer collected in 'Step 1'.
- Boundary markers: None; the input is directly interpolated into markdown and skill templates.
- Capability inventory: Directory creation ('mkdir'), application execution ('open'), and file system writes.
- Sanitization: None identified; the agent is instructed to write the user's personal description and inferred roles directly to files.
- [COMMAND_EXECUTION]: The skill modifies the global user configuration file '~/.claude/CLAUDE.md' by appending a 'Personal Context' section. This is a persistence mechanism that ensures the specific instructions and context of the Obsidian vault are loaded in every future session of the agent on the machine.
- [COMMAND_EXECUTION]: The skill executes shell commands to automate the environment setup, including creating directory structures ('mkdir -p') and launching the Obsidian application ('open -a Obsidian').
Audit Metadata