Obsidian-CLI-skill: why it is not safe to use

The Obsidian-CLI-skill documents a command-line interface for the Obsidian desktop app. Our scan found no prompt injection, no external network calls, no data exfiltration, and no hardcoded secrets or credential access. It runs at normal user privilege and touches only your local vault. We rated it warn (79/100) on one dimension: the powerful commands it exposes.

What we found

The skill surfaces two genuinely destructive capabilities. First, a permanent file delete that removes notes outright rather than moving them to trash, so an accidental or misdirected call can lose data with no easy recovery. Second, an eval command that runs arbitrary JavaScript against the running Obsidian instance, which effectively grants the skill full programmatic control of the app. In an agent context, either command could act on a vague or misread instruction with no confirmation step.

What to do instead

Use the skill on a vault you have backed up or version-controlled. Keep the delete and eval commands under human review rather than fully autonomous use, and confirm the exact target before running them. If you only need read or standard edit operations, prefer those and leave the destructive commands disabled.