Security audit
Security checks for vulnerabilities and agentic risk
This skill is for writing Obsidian notes, but it can automatically commit and push vault changes to Git from broad triggers, so users should review it before installing.
Install only if you want an agent to write files into your Obsidian vault and potentially push those changes to a Git remote. Before using it, confirm the vault path, Git remote, and whether pushes should require your explicit approval.
The trigger list includes broad everyday terms like "obsidian", "canvas", and especially the generic Chinese term "笔记" (notes), which can cause the skill to activate in many unrelated conversations. Because this skill writes files and the workflow states it will automatically commit and push via Git, accidental activation can lead to unintended persistence and exfiltration of user content.
The workflow states that the agent will automatically "Git commit + push," but the skill description and guardrails do not present this as an explicit user-facing warning or consent gate. In this context, writes are not merely local edits: they become durable, propagated to other devices, and potentially uploaded to a remote repository, increasing the risk of accidental disclosure of sensitive notes or unintended system changes.
No suspicious patterns detected.
