obsidian-publish-all
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local TypeScript scripts located in the scripts directory and uses the ob command-line interface to publish locale data. These actions are standard for the repository's maintenance workflows.
- [DYNAMIC_EXECUTION]: The skill uses npx tsx to execute TypeScript files like scripts/publish-all.ts and scripts/build-publish-js.ts at runtime, which is a common developer practice for running build scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill functions as a processing surface for repository metadata. It ingests data from scripts/locales.json and various locale-specific directories. While boundary markers or explicit sanitization are not described in the skill metadata, the capabilities are limited to standard publishing operations within a controlled vendor repository.
Audit Metadata