obsidian-mcp
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: Safety-Focused Architecture. The skill enforces a strict 'read-before-write' policy and requires readback verification for all vault modifications to prevent data loss or silent corruption.\n- [SAFE]: API Restriction. It proactively identifies and forbids the use of specific MCP tools (obsidian_patch_note and obsidian_append_to_note) that have known schema-mismatch issues on the target host environment.\n- [SAFE]: Automated Validation. Includes a local validation script (validators/api-safety-check.sh) that audits execution logs for compliance with safety constraints and confirms user authorization for destructive operations like overwrites.\n- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill reads content from Obsidian notes (untrusted data) and possesses vault modification capabilities. \n
- Ingestion points: Vault data enters through obsidian_get_note and obsidian_search_notes (referenced in SKILL.md and examples.md).\n
- Boundary markers: Implements strict verification steps and mandates readback comparison to validate that changes match the intended plan (SKILL.md).\n
- Capability inventory: Note creation, modification, and frontmatter/tag management across all scripts.\n
- Sanitization: Relies on structural verification (document-maps) and verification reporting rather than content-based filtering.
Audit Metadata