soia-pkm-transform-obsidian-pdf
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
osascriptto perform UI automation within the Obsidian desktop application to trigger native PDF export features. It also executespdfinfoandpdftoppmto inspect and validate the generated PDF files. - [EXTERNAL_DOWNLOADS]: The skill instructions guide the user to install additional dependencies from the
soia-teamorganization via the Claude plugin marketplace and GitHub. - [REMOTE_CODE_EXECUTION]: The skill uses
npxto dynamically load and execute vendor-provided logic from thesoia-team/soia-open-pkm-vault-skillsrepository. - [PROMPT_INJECTION]: (1) Ingestion points: The skill processes data from external URLs (via
soia-pkm-clip-*) and local files within the user's vault. (2) Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the conversion workflow. (3) Capability inventory: Access to system commands (osascript,pdfinfo,pdftoppm) and the ability to read and write files in the local file system. (4) Sanitization: The instructions do not specify any validation or sanitization steps for the external content before it is rendered into PDF format.
Audit Metadata