Security audit
Security checks for vulnerabilities and agentic risk
The verdict is benign with medium confidence: the scanners found Obsidian vault actions and screenshot capture that are not fully reflected in the skill description, and the scan was partial.
The verdict is benign, but consider whether you want the skill to move or delete notes and save an application screenshot. The scanner found no executable scripts and AIG reported no findings, but Skillspector marked its analysis partial because some local path references were unresolved.
The code uses the declared CLI and operates on the expected vault resources, but its commands perform relocation and deletion rather than the listed operations. In particular, deleting a note is a distinct, undeclared capability rather than a supporting implementation detail of reading, searching, creating, or editing notes.
Plugin reload and counting vault files are consistent with the declared scope, and developer error inspection can support plugin management. However, capturing the application UI introduces an undeclared data-capture capability beyond the described note, task, link, property, and plugin operations. The supplied JavaScript only counts files; it does not demonstrate broader data access or exfiltration.
