x-to-obsidian
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinsync_telegram_export.pyandsync_telegram_saved.pyto call the internalarchive_x.pyscript. These calls are implemented using argument lists rather than shell strings, which prevents shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The
archive_x.pyscript makes network requests toapi.fxtwitter.comandcdn.syndication.twimg.comto fetch tweet metadata and media components without requiring an official X API key. - [PROMPT_INJECTION]: The skill processes untrusted content from X posts and Telegram messages to generate summaries and tags via the AI agent. This constitutes an indirect prompt injection surface.
- Ingestion points: archive_x.py (from fxtwitter), sync_telegram_export.py (from JSON), sync_telegram_saved.py (from MTProto)
- Boundary markers: Absent in the prompt construction logic
- Capability inventory: Local file system writes to the Obsidian vault, subprocess execution of bundled Python scripts, and network GET operations
- Sanitization: Filename sanitization is implemented using regex in
sanitize_title_for_filename; content-level sanitization for AI processing is not present.
Audit Metadata