Security audit
Security checks for vulnerabilities and agentic risk
The verdict is benign because the scanners found no reported malicious behavior, though they flagged capabilities beyond the stated Obsidian vault-management purpose and some artifact references could not be resolved.
Before installing, decide whether you need note deletion, moving, and screenshot capture, and whether you are comfortable granting access for those actions. The scan was partial because it could not resolve several references, so the available evidence is incomplete.
The commands use the declared CLI and operate on the expected vault resources. However, the supplied chunk performs relocation and deletion rather than the listed read/search/create/edit operations. Deletion is a material undeclared capability, not merely a supporting implementation detail.
Plugin reloading is explicitly within scope, and error inspection can support plugin work. The evaluated JavaScript only counts vault files, which is consistent with vault inspection. However, capturing the application UI accesses and exports visual content beyond the declared note, task, link, property, and plugin operations.
