Security audit
Security checks for vulnerabilities and agentic risk
This is a real Obsidian vault utility, but it can rewrite many local notes without safeguards and has some misleading command behavior.
Review this before installing if your Obsidian vault contains important personal or work notes. Use it only on a backed-up or version-controlled vault, avoid running bulk replace on untrusted vaults, and treat search and replace patterns as regular expressions even when the interface suggests otherwise.
obsidian-cli.py:145Vault Boundary Bypass Through Symbolic-Link Writes
obsidian-cli.py:138Unconditional Regular-Expression Interpretation in Search and Bulk Replacement
The documented behavior does not align with the analyzed behavior, including overstated export/format support and tag-management claims. Security-relevant mismatches reduce user ability to make informed consent decisions and can hide unexpected file handling behavior, especially in a tool that directly accesses local knowledge-base contents.
The skill advertises direct operations on a local Obsidian vault, including search, export, and batch replacement, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent may gain undeclared file read/write capability over user notes, making sensitive data access and destructive edits harder to constrain or review.
The skill describes bulk replacement, tag changes, export, and cleanup of empty or duplicate notes without any warning that these operations may directly modify or delete user files. In the context of a local Obsidian vault, this is particularly risky because notes often contain high-value personal or work data and changes may be irreversible if backups are absent.
The usage example demonstrates a bulk replace command operating on the entire local knowledge base without warning that it will directly rewrite note contents. This can lead users or agent systems to trigger widespread unintended edits, corrupt notes, or alter sensitive records at scale with little friction.
Comments, help text, and runtime messages are consistently hard-coded in Chinese, and the script explicitly sets stdout encoding behavior. This imposes a specific language/locale experience without user opt-in or any mechanism to select another language, which matches the policy's language-choice concern.
The replace command performs in-place writes to every matching markdown file in the vault, which can modify large amounts of user data irreversibly. Although progress is printed, there is no confirmation prompt, dry-run safeguard, or warning comment/docstring disclosing the destructive nature of the operation before writes occur.
The argument parser documents a '--regex' option as if regex behavior is optional, but cmd_search compiles args.keyword directly with re.compile at L040 and never checks args.regex. This creates an active documentation/interface contradiction: users are told regex must be enabled explicitly, while the implementation always enables regex semantics.
The CLI exposes a '--format' option with choices 'markdown', 'html', and 'txt', implying export conversion capability. However, cmd_export ignores args.format entirely and simply writes the original markdown content to the output path at L185-L186, so the documented capability contradicts actual behavior.
The export command creates directories and writes copies of note contents to an output path, which affects user data placement on disk. While it prints destination progress, the code lacks an up-front disclosure in comments/docstrings or a stronger warning that notes will be copied out of the vault to another location.