OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit May 19, 2026
Independent checks from skills.sh's audit partners.
This skill queries a local knowledge base (Obsidian wiki) and requires access to sensitive files like .env and local config folders to resolve the vault path. It executes shell commands using the qmd CLI and interpolates user search terms, which poses a command injection risk. It also processes untrusted markdown content, creating a risk of indirect prompt injection.
Detected behaviors
No alerts
1 issue
Score: 93/100 · 2 sections analyzed