Obsidian 1

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is coherent for using Obsidian notes, but users should know it can read, create, move, edit, and delete vault notes.

Install this only if you are comfortable letting the agent use obsidian-cli on your Obsidian vaults. Before allowing create, move, direct edit, or delete actions, confirm the vault and note path, and consider backups for important notes.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If invoked on the wrong path or vault, the agent could change or remove notes the user wanted to keep.

Why it was flagged

The skill documents commands that can create, move, and delete notes in a user's Obsidian vault. This is aligned with the stated purpose, but it gives the agent real local data mutation capability.

Skill content
Create
- `obsidian-cli create "Folder/New note" --content "..." --open`

Move/rename (safe refactor)
- `obsidian-cli move "old/path/note" "new/path/note"`

Delete
- `obsidian-cli delete "path/note"`
Recommendation

Confirm the target vault and note path before move/delete operations, and keep vault backups or version control if using automated edits.

What this means

Private note content could be exposed to the agent during searches, and misleading text inside notes could influence the agent if not treated as ordinary user data.

Why it was flagged

The skill can retrieve persistent note content into the agent context and edit that persistent content. Obsidian notes may be private and should not automatically be treated as authoritative instructions.

Skill content
`obsidian-cli search-content "query"` (inside notes; shows snippets + lines)

Prefer direct edits when appropriate: open the `.md` file and change it; Obsidian will pick it up.
Recommendation

Use specific queries and vault paths, avoid unnecessary searches over sensitive notes, and treat retrieved note text as content to analyze rather than instructions to obey.

What this means

The external CLI will be used to access and modify local Obsidian vault files.

Why it was flagged

The skill depends on an external Homebrew tap to provide the obsidian-cli binary. This is disclosed and purpose-aligned, but it means the installed external tool must be trusted.

Skill content
brew | formula: yakitrak/yakitrak/obsidian-cli | creates binaries: obsidian-cli
Recommendation

Review or trust the Homebrew formula/source before installing, and keep the CLI updated from a trusted source.