vault-insights
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes the entire contents of a local Obsidian vault to build mental models and extract insights. This creates an indirect prompt injection surface where malicious content within notes could attempt to manipulate the agent's logic.
- Ingestion points: Markdown files (*.md) in the '~/Documents/obsidian-vault/' directory.
- Boundary markers: None identified; the instructions direct the agent to 'read every note' without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill uses the 'Edit' tool (writing to daily notes), the 'Bash' tool (executing CLI commands), and the 'Task' tool (subagent orchestration).
- Sanitization: There is no mention of sanitizing, escaping, or validating the note content before it is processed.
- [COMMAND_EXECUTION]: The skill uses the 'Bash' tool to invoke the GitHub CLI ('gh pr view') using PR identifiers found within note content. While this targets a well-known service, the execution parameters are derived from untrusted local data.
Audit Metadata