obsidian-bases
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to aggregate and display properties and content from multiple notes in an Obsidian vault.\n
- Ingestion points: Data enters the context via note frontmatter (
file.properties,note.author) and file metadata referenced in the.basefile configuration (SKILL.md).\n - Boundary markers: The YAML file structure provides clear field boundaries, though formula expressions within these fields interpret string data.\n
- Capability inventory: The skill enables the creation and modification of
.baseconfiguration files which dictate how the agent or the Obsidian plugin processes vault data (SKILL.md).\n - Sanitization: While an
escapeHTML()function is available in the reference documentation, the skill does not explicitly require its use for all user-controlled properties (references/FUNCTIONS_REFERENCE.md).\n- [DYNAMIC_EXECUTION]: The skill provides a formula language that allows for the execution of logic and data transformations at runtime within the Obsidian environment. This includes anhtml()function which renders strings directly as HTML, posing a potential risk for Cross-Site Scripting (XSS) if properties containing malicious HTML are processed without proper escaping (references/FUNCTIONS_REFERENCE.md).
Audit Metadata