obsidian-to-x
Warn
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
pkillto terminate existing Chrome or Chromium processes using remote debugging ports to prevent port conflicts during browser automation. - [COMMAND_EXECUTION]: Uses platform-specific utilities to simulate 'Paste' keyboard shortcuts (Cmd+V/Ctrl+V), utilizing
osascripton macOS, PowerShell on Windows, andxdotoolorydotoolon Linux. - [REMOTE_CODE_EXECUTION]: Dynamically generates and executes Swift code on macOS (via
swiftcommand) to handle image data transfer to the system clipboard, which is a form of runtime code generation and execution. - [EXTERNAL_DOWNLOADS]: Automatically downloads remote images referenced in Markdown notes to a local temporary directory using
curland the Node.jshttpsmodule. - [COMMAND_EXECUTION]: Spawns various system processes including
bun,npx,jq, and browser executables usingchild_process.spawnandspawnSyncacross multiple scripts. - [DATA_EXFILTRATION]: Accesses local Obsidian configuration files (e.g.,
.obsidian/workspace.json,.obsidian/app.json) and reads the contents of user notes to facilitate content conversion and publishing.
Audit Metadata