Craft API Skill and Obsidian Migration Tool

• Analyzed: May 12, 2026, 3:12 AM
• Findings: 1
• Version: 1.0.0
• Hash: 60d68ce1cdb3f54922a41930e7b9ece1ab65f1111bf279175245b3e7df7b1a44
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides legitimate integration with Craft.do, including tools for Obsidian vault migration, task management, and document organization. All scripts (`cleanup-craft.sh`, `craft-api.sh`, `migrate-obsidian-nested.sh`, `migrate-obsidian.sh`) use `curl` to interact with a user-defined Craft.do API endpoint and API key. File system access is limited to reading user-specified Obsidian vault paths and example `mission-control` JSON files for data synchronization, which is directly aligned with the stated purpose. There is no evidence of unauthorized data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts to subvert the agent's intended behavior.