obsidian-bases
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and process data from Obsidian notes (Markdown files) to generate computed views, creating an indirect prompt injection surface where malicious instructions in note properties could influence the agent.
- Ingestion points: Note metadata, tags, and properties are accessed as defined in
SKILL.md(Properties section) andreferences/FUNCTIONS_REFERENCE.md(File Functions). - Boundary markers: There are no instructions for the agent to use delimiters or specific warnings to ignore instructions embedded in the processed note data.
- Capability inventory: The agent is authorized to create and modify
.basefiles in the vault (SKILL.md) and can use thehtml()function to render content (references/FUNCTIONS_REFERENCE.md). - Sanitization: The
references/FUNCTIONS_REFERENCE.mdfile documents anescapeHTML()function, but its use is not integrated into the core workflow or mandatory examples.
Audit Metadata