Obsidian - read, search, write and edit direct to obsidian vault.
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A mistaken, malicious, or injected folder value could make the agent create or overwrite a Markdown file outside your intended vault, under the user account's normal file permissions.
The folder argument is used directly to build the write path, then the file is written. The shown function does not reject absolute paths, '..' traversal, or existing target files, so a create operation is not clearly limited to the intended Obsidian vault.
def create_note(vault: Path, title: str, content: str = '', folder: str = None,
...
if folder:
note_dir = vault / folder
note_dir.mkdir(parents=True, exist_ok=True)
...
note_path = note_dir / f"{safe_title}.md"
...
note_path.write_text(full_content, encoding='utf-8')Constrain folder paths by resolving them under the vault, reject absolute paths and '..' segments, check before overwriting existing files, and require explicit user confirmation for any write outside the expected vault folder.
Searches and answers may expose the contents of notes in the configured vault to the active agent session.
The search helper reads Markdown files across the configured vault and returns matched context to the agent. This is purpose-aligned for a knowledge-base skill, but it means private notes can enter the agent context.
for md_file in vault.rglob('*.md'):
...
content = md_file.read_text(encoding='utf-8')
...
'context': context[:500]Point the skill only at the vault you intend the agent to read, avoid storing secrets in that vault, and treat retrieved note text as untrusted context rather than instructions.
It is harder to verify who maintains the skill or compare it against an upstream project.
The package does not provide an upstream source or homepage for independent verification. No remote install behavior is shown, so this is a provenance note rather than evidence of malicious behavior.
Source: unknown Homepage: none
Install only if you trust the publisher, and review the included scripts before allowing them to modify important notes.