Obsidian Task

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward Obsidian task helper, but it can make persistent changes to task notes and relies on a local Obsidian CLI dependency.

This skill appears safe for its stated purpose if you want an agent to manage Obsidian tasks. Use care with write operations: confirm the vault file, task line number, and appended content before allowing changes.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If used on the wrong file or line, the agent could mark the wrong task done/undone or add unwanted task content to an Obsidian note.

Why it was flagged

These documented commands can change task state or append new content in an Obsidian vault. This is expected for the skill's purpose, but it is still a persistent local data mutation.

Skill content

obsidian task file=<project_slug>/todo line=2 toggle
obsidian task file=<project_slug>/todo line=2 done
obsidian append file=<project_slug>/todo content="- [ ] task name"

Recommendation

Before allowing write actions, confirm the target file, line number, and content, especially for important vaults.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill will only behave as expected if the user's local obsidian command is installed, enabled, and is the intended Obsidian CLI.

Why it was flagged

The skill depends on the local obsidian CLI. The supplied registry metadata says no required binaries are declared, so automated install checks may not enforce this dependency.

Skill content

requires:
    bins:
      - obsidian

Recommendation

Verify the obsidian CLI installation and path before use, and ensure it is the official/local command you intend the agent to call.