obsidian-vault-sync-2eb388 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited obsidian-vault-sync-2eb388 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Project-agnostic, global skill. It keeps an Obsidian Vault honest: scans the live codebase and the vault in parallel, diffs their states across 11 checks, and applies fixes only after the user approves each finding. The vault is always a mirror of ground truth — this skill is the sync mechanism that maintains that property over time.
Pairs with /obsidian-vault (which creates the vault). If no vault exists yet, stop and direct the user there.
| Flag | Limits audit to |
|---|---|
--tags | Tag drift and taxonomy checks only |
--content | Note staleness, dead links, orphans, ADR staleness |
--structure | Folder structure, canvas, _AI-CONTEXT.md drift |
--plugins | Plugin/settings recommendations only |
--all | All checks (default when no flag is given) |
<repo>/.obsidian-vault/ by default; ask if not found./obsidian-vault first.--all).scanning.
Spawn both simultaneously and wait for both to return before proceeding:
Agent A — Codebase scan (built-in `Explore` agent, read-only):
"Scan this repository and return a structured summary: (1) all top-level components/modules (folder names, package names from manifests), (2) key file paths (README, entrypoints, CI config, any architecture docs), (3) recent git activity — files added, deleted, or renamed in the last 60 commits (run git log --diff-filter=ADR --name-status --oneline -60), (4) any file paths that were deleted or renamed. Return a structured plain-text report — no file dumps, no code excerpts."Agent B — Vault scan (`vault-scanner` custom agent): Spawn the vault-scanner agent (defined in this repo under global/claude/agents/vault-scanner.md) against the vault root. It returns a structured vault state report covering: all notes with their frontmatter, wikilinks, and sizes; all tags in use; tags defined in _TAG-TAXONOMY.md; folder structure; orphan candidates; dead wikilinks; .obsidian/ config contents; template frontmatter schemas; and all Dataview query blocks.
Cross-reference Agent A and Agent B outputs to evaluate every active check. For each check, produce a finding entry:
[CHECK NAME] severity: high | medium | low
Summary: <one sentence>
Affected: <list of file paths or note titles>
Action: <add note | update frontmatter | fix wikilink | update canvas | skip | manual>The 11 checks and their logic:
01-Architecture/ or 06-Reference/. Severity: high if component has >5 source files.
deleted/renamed list. Severity: high if the note is an active ADR or architecture note.
related: values from Agent B that don't resolve toany note path in Agent B's inventory. Severity: medium.
referenced by any other note's related: field. Severity: low (may be intentional stubs).
_TAG-TAXONOMY.md → severity: medium_TAG-TAXONOMY.md never used in any note → severity: lowtype: value. Derive required fields by reading _templates/TPL-<type>.md frontmatter. Severity: medium (breaks Dataview queries).
type: adr and status: active that contain file pathsappearing in Agent A's deleted/renamed list. Severity: high.
Architecture.canvas against components inAgent A output: nodes for deleted components (remove), missing nodes for new ones (add). Severity: medium.
_AI-CONTEXT.mddescribes, or new tag conventions exist that aren't documented there. Severity: medium.
FROM path orfilter on a type:/status: value that doesn't appear in Agent B's folder structure or note inventory. Severity: medium.
community-plugins.json againstvault usage patterns (e.g., Tasks plugin listed but no task syntax found in notes → flag as unused). Use WebFetch for one targeted lookup only if clearly useful (e.g., checking whether a listed plugin has been deprecated). Severity: low.
Show all findings before touching anything. Group by severity (high → medium → low). For each finding, show the check name, severity, affected files, and recommended action. Finish with a summary: N high / M medium / P low findings. Nothing changed yet.
If no findings: report "vault is fully in sync — nothing to update" and stop.
Ask the user: approve all high-severity findings, or go item by item?
For each approved finding, apply using this decision tree:
Safe to apply directly (no user content at risk):
#component/<name> tags to _TAG-TAXONOMY.mdArchitecture.canvas nodes (add/remove nodes for new/deleted components)related: wikilink if the correct target is unambiguous_AI-CONTEXT.md folder list / tag conventions sectionRequires diff review before applying:
side-by-side diff of proposed changes vs current content; user chooses apply / skip / manual-merge.
Never apply automatically (always manual):
status: active where the proposed change rewrites meaning, not just metadata<vault-root>/00-Home/_Sync-Backlog.md for follow-up.
obsidian-vault-sync on an up-to-date vault shouldproduce zero findings.
approval. User content is irreplaceable; vault structure is not.
Agent B actually returned.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.