note-promotion

SUSPICIOUS: the skill’s note-promotion behavior is coherent and bounded, with user confirmation before writes, but it relies on an ambiguous community 'obsidian-mcp' dependency whose likely ecosystem involves third-party credential handling, unpinned execution paths, and possible TLS verification disabling. The skill content itself is not malicious; the main risk is external MCP trust and credential/data routing outside official Obsidian-owned infrastructure.