autograph

SUSPICIOUS. The skill is mostly coherent for Obsidian vault maintenance, and the local file access/modification matches its purpose. However, a meaningful subset of functionality routes vault-derived content and an API key through OpenRouter, a third-party aggregation service rather than a direct vendor API, while the docs strongly encourage those enrichment steps. This is not confirmed malware, but it creates medium security risk and data exposure beyond a purely local vault tool.

The visible code is an LLM-assisted vault enrichment tool that sends note excerpts and metadata, along with OPENROUTER_API_KEY for authentication, to https://openrouter[.]ai/api/v1/chat/completions. No clear malicious intent or unauthorized system-data collection is shown, but this disclosure may expose sensitive vault content to the service. With --apply, unvalidated result paths could cause writes outside the vault if result data is hostile or altered. The supplied fragment is syntactically incomplete; overall severity is moderate due to data disclosure and path traversal risk, not demonstrated malware.

This utility scans Markdown files and performs duplicate merging, link redirection, and file moves. The manifest-application path handling permits traversal outside the vault through crafted canonical or extras paths, creating a significant filesystem integrity risk when an untrusted manifest is applied. No network exfiltration, credential access, or other malware behavior is evident; severity is medium to high depending on manifest trust.

This code generates Markdown indexes from a local notes vault and performs no network communication or command execution. A domain value from note frontmatter or the --domain argument is used directly in an output filename, creating a path-traversal risk that could overwrite files outside the intended MOC directory (for example, `MOC-{domain}.md`); no specific external domain or credential target is present. Severity is moderate and depends on processing untrusted vault content or arguments.