Obsidian Vault Context

• Outcome: Pass
• Latest audit: May 29, 2026, 8:30 PM
• Version:
  1.0.1

Overview

The skill appears to be a vault-focused helper whose local file reads and writes are disclosed and purpose-aligned, though users should be careful because it may edit persistent vault files.

Install this only if you want an agent to help manage files in your vault. Before letting it run, ask the agent to summarize intended file changes and get your confirmation for creates, edits, or overwrites, especially in important notes or operational files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger list includes broad phrases such as "any vault-related file operation," which can cause the skill to activate in many situations involving file access. Because the skill authorizes reading and writing persistent user data, unintended invocation can lead to unnecessary modification of vault contents or overbroad access to user notes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to create and update files in the user's vault but does not require a user-facing warning or confirmation before modifying persistent data. In a shared workspace containing important notes and operational files, this increases the risk of accidental data creation, overwrites, and unintended state changes across sessions.

VirusTotal

64/64 vendors flagged this skill as clean.