vault-report
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves the execution of local CLI commands using predefined templates and configuration files. This behavior is localized and necessary for the primary function of performing graph analysis on an Obsidian vault.
- [PROMPT_INJECTION]: The skill processes metadata from an Obsidian vault, such as folder names and note counts, to generate analytical summaries. This creates a surface for indirect prompt injection where specific naming conventions in the vault could theoretically influence the agent's summary output. This is a low-risk surface inherent to data analysis tools. Ingestion points: Vault metadata ingested via the obsidian-graph-query skill results. Boundary markers: No explicit delimiters are used to separate ingested metadata from agent instructions in the report templates. Capability inventory: Local CLI execution for graph queries and reading of local configuration files. Sanitization: The skill does not implement specific sanitization of vault metadata before including it in the report output.
Audit Metadata