doc-vault-project
Pass
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands and local CLI utilities to manage the Obsidian vault's directory structure and note content.
- Execution mechanisms: Employs
mkdir -pfor scaffolding project directories andlsfor status monitoring. - CLI Integration: Interfaces with
notesmd-clito retrieve vault paths and perform CRUD operations, andqmdfor search and indexing. - Sanitization: The instructions explicitly mandate converting user-provided project and note names into kebab-case slugs (max 40-60 characters). This design choice effectively prevents shell injection and path traversal by ensuring inputs conform to a restricted character set before being used in file system paths.
- Capability inventory: File system modification is restricted to the local vault path as defined by
notesmd-cli, and network operations are absent. - [SAFE]: No obfuscation, data exfiltration, or unverifiable remote code patterns were identified. The skill's behavior is consistent with its stated purpose of local vault management.
Audit Metadata