skills/opencue/skills/obsidian-bases/Gen Agent Trust Hub

obsidian-bases

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is designed to ingest and process untrusted data from an Obsidian vault (e.g., note properties, tags, and frontmatter).
  • Ingestion points: The skill reads external data via properties like note.author, file.properties, and file.tags (documented in SKILL.md and FUNCTIONS_REFERENCE.md).
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands in the processed data are provided in the workflow.
  • Capability inventory: The skill defines formulas and views that can manipulate and render this data. Notably, the html() function in FUNCTIONS_REFERENCE.md allows rendering strings as HTML, which could lead to cross-site scripting (XSS) or further injection if malicious content from a note is rendered without using the provided escapeHTML() function.
  • Sanitization: While an escapeHTML() function exists in the reference, the skill instructions do not mandate its use when processing untrusted note content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 10:52 PM
Security Audit — agent-trust-hub — obsidian-bases