obsidian-publisher
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The create_note function in SKILL.md uses the folder argument to construct a file path without verifying that it remains within the resolved vault_path. This could allow directory traversal using ../ sequences to write files to unintended locations on the file system, although the skill enforces a .md extension on all written files.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown content and writes it directly to the local vault, which creates a vulnerability surface where malicious instructions could be stored and later processed by other tools or agents.
- Ingestion points: The content and frontmatter parameters in the create_note function in SKILL.md.
- Boundary markers: Absent. The content is written raw to the file system without delimiters or specific warnings to ignore embedded instructions.
- Capability inventory: File system write operations (Path.write_text) and directory creation (Path.mkdir) in SKILL.md.
- Sanitization: While illegal filename characters are replaced with hyphens, there is no validation of the folder directory structure or the markdown content itself.
Audit Metadata