obsidian-bases
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is designed to ingest and process untrusted data from an Obsidian vault (e.g., note properties, tags, and frontmatter).
- Ingestion points: The skill reads external data via properties like
note.author,file.properties, andfile.tags(documented in SKILL.md and FUNCTIONS_REFERENCE.md). - Boundary markers: No specific delimiters or instructions to ignore embedded commands in the processed data are provided in the workflow.
- Capability inventory: The skill defines formulas and views that can manipulate and render this data. Notably, the
html()function inFUNCTIONS_REFERENCE.mdallows rendering strings as HTML, which could lead to cross-site scripting (XSS) or further injection if malicious content from a note is rendered without using the providedescapeHTML()function. - Sanitization: While an
escapeHTML()function exists in the reference, the skill instructions do not mandate its use when processing untrusted note content.
Audit Metadata