obsidian-basics
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of the Obsidian CLI for vault and plugin management, specifically highlighting the
obsidian evalcommand which allows for the execution of arbitrary JavaScript within the application's renderer process. - [REMOTE_CODE_EXECUTION]: Detailed guides and code snippets are provided for automating Obsidian via the Chrome DevTools Protocol (CDP). This includes using the
Runtime.evaluatemethod to execute code over a WebSocket connection to a local debugging port. - [SAFE]: The skill explicitly warns users about the security risks associated with unauthenticated debugging ports and the execution of arbitrary code, advising that such features should only be used with trusted scripts and kept restricted to localhost.
Audit Metadata