obsidian-vault-search
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it retrieves and processes content from Obsidian notes that may contain untrusted data or malicious instructions.
- Ingestion points: Note content and frontmatter are read from the
$VAULT_PATHusinggrep,cat, andheadas defined inSKILL.md. - Boundary markers: The skill lacks explicit instructions or delimiters to separate note content from the agent's internal instructions, increasing the risk that the agent might follow instructions found within a note.
- Capability inventory: The skill has access to
bash(includingpython3,grep,find) and filesystem read capabilities. - Sanitization: There is no specified sanitization or filtering of the content retrieved from notes before it is presented to the user or processed by the model.
- [COMMAND_EXECUTION]: The skill relies on executing shell commands via
bashto perform searches. While these are focused on the local vault, the commands use variables like$VAULT_PATHand search terms which are interpolated into the command strings.
Audit Metadata