Security Audit
mattpocock/skills:skills/personal/obsidian-vault
github.com/mattpocock/skillsTrust Assessment
mattpocock/skills:skills/personal/obsidian-vault received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via Unsanitized Filenames in Shell Commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on July 17, 2026 (commit 9603c1cc). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential Command Injection via Unsanitized Filenames in Shell Commands The skill documentation instructs the LLM to execute shell commands (such as `find` and `grep`) using user-provided keywords or note titles directly in the command line. If a note title or search keyword contains shell metacharacters (e.g., `; rm -rf /`, backticks, or `$()`), this can lead to arbitrary command execution in the host environment. Avoid executing raw shell commands with user-supplied input. Instead, use native, structured APIs or tools provided by the agent framework to perform file searches, globbing, and content grep operations safely. | LLM | SKILL.md:25 |
Scan History
Embed Code
[](https://skillshield.io/report/63f6f7ce59546df4)
Powered by SkillShield