obsidian-bases
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill documents a DSL for Obsidian Bases that processes untrusted data (note frontmatter, file metadata) from the local vault. This creates a surface for indirect prompt injection, particularly through the
html()function which allows rendering strings as HTML, potentially leading to XSS if note properties contain malicious scripts. The skill includes theescapeHTML()function to help mitigate these risks, although its implementation depends on the generated formula.\n - Ingestion points: Note frontmatter properties, file metadata (name, path, size, etc.), and file content accessed through the
file(path)function.\n - Boundary markers: No specific delimiters or warnings for processed data are defined in the schema.\n
- Capability inventory: Access to vault files via
file(), HTML rendering viahtml(), regex matching viamatches(), and various data manipulation functions defined in thereferences/FUNCTIONS_REFERENCE.md.\n - Sanitization: An
escapeHTML()function is provided in the documentation but its use is not enforced by the schema or default examples.
Audit Metadata