obsidian-bases
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFEPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill facilitates processing untrusted data from the user's Obsidian vault (frontmatter, tags, file properties) to generate .base files. A malicious note could influence the agent's logic during the creation of views, filters, or formulas. 1. Ingestion points: Note properties (note.author), file metadata (file.tags), and frontmatter (file.properties) accessed via the file() and property reference syntax. 2. Boundary markers: None. There are no instructions for the agent to sanitize or delimit note-provided strings when interpolating them into YAML content. 3. Capability inventory: The agent can create, edit, and configure .base files which are then interpreted by the Obsidian Bases plugin. 4. Sanitization: Not specified in instructions.
- [REMOTE_CODE_EXECUTION]: Potential for Cross-Site Scripting (XSS) via dynamic HTML execution. The skill reference defines an html() function that allows rendering strings directly as HTML within the Obsidian application. The skill instructs the agent to define computed properties using the documented DSL. If the agent uses untrusted input from vault notes in an html() formula without calling escapeHTML(), it could lead to script execution in the context of the Obsidian app.
Audit Metadata