obsidian-web-clipper
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a template system for processing external web content from the browser DOM through LLM "interpreters," which presents a surface for indirect prompt injection.\n
- Ingestion points: Templates use variables such as
{{content}},{{selectorHtml}}, and{{schema}}to ingest arbitrary data from active browser tabs (SKILL.md).\n - Boundary markers: The documentation recommends using structured delimiters like
<page>tags to wrap context and keep AI interpreter prompts focused, which acts as a partial mitigation.\n - Capability inventory: The extension captures content to create Markdown notes in an Obsidian vault (file write capability) based on template definitions.\n
- Sanitization: The skill identifies filters like
|markdownfor converting HTML content to a safer format.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch technical documentation and logic rules from external repositories associated with a well-known service.\n - Evidence: Directs the agent to retrieve data from
github.com/obsidianmd/obsidian-clipperandgithub.com/obsidianmd/obsidian-helpto ensure template accuracy (SKILL.md).\n- [CREDENTIALS_UNSAFE]: The skill provides proactive guidance on secret management related to the extension's configuration files.\n - Evidence: Explicitly warns that extension settings exports contain plaintext API keys and advises users to avoid version-controlling these files or quoting keys in prompts (SKILL.md).
Audit Metadata