z-obsidian-cli
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and search through user notes, which are untrusted data sources that could contain hidden instructions for the agent.
- Ingestion points: The agent reads note content using
obsidian vault=V read path=...and search results (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the note content being read.
- Capability inventory: The skill possesses the ability to create files, append content, and modify note properties using the
obsidianCLI. - Sanitization: The skill provides defensive instructions to the agent to use safely quoted arguments or argument-vector interfaces to prevent note content from being interpreted by the shell.
- [COMMAND_EXECUTION]: The skill's primary function is to execute the
obsidianCLI command on the host system. It correctly identifies and warns against shell expansion risks (e.g., backticks or dollar expressions) when passing content to the command line.
Audit Metadata