wiki — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wiki (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Treat the installed product as code and the selected user vault as data. Never use the plugin/product root as a vault, even when the current directory happens to be the product checkout.
Resolve the portable core from this skill's installation and invoke it by absolute path:
CORE=/absolute/product/root/scripts/claude-obsidian.py
python3 "$CORE" --helpResolve a vault in this order: explicit --vault, CLAUDE_OBSIDIAN_VAULT, the nearest .claude-obsidian.json, then an unambiguous initialized vault at or above the current directory. Fail closed when selection is missing or ambiguous.
Baseline setup requires no network egress. Do not fetch templates, plugins, or remote content unless the user separately approves the destinations and budget.
Use the deterministic setup commands. Both are dry-run by default.
For a new, separate vault:
python3 "$CORE" init /absolute/path/to/vault \
--generated-at <ISO-UTC> --operation-id init-reviewed
python3 "$CORE" init /absolute/path/to/vault \
--generated-at <ISO-UTC> --operation-id init-reviewed \
--approved-plan-sha256 <reviewed-sha256> --applyFor an existing Obsidian vault:
python3 "$CORE" adopt /absolute/path/to/vault \
--generated-at <ISO-UTC> --operation-id adopt-reviewed
python3 "$CORE" adopt /absolute/path/to/vault \
--generated-at <ISO-UTC> --operation-id adopt-reviewed \
--approved-plan-sha256 <reviewed-sha256> --applyBefore --apply, show the selected path and changed-path preview, then pass the emitted approved_plan_sha256 unchanged. Do not use --force unless the user has reviewed the conflicts and explicitly approved replacement. Setup is non-destructive by default and creates no upstream Git remote.
If the user asks for a domain-specific scaffold, establish the baseline first, then read modes.md. Draft the additional pages and configuration as one operation-level transaction. Never mutate vault files with host Write/Edit tools or an Obsidian transport.
Route the user's intent without silently broadening it:
| Intent | Skill |
|---|---|
| Ingest supplied sources | wiki-ingest |
| Answer from existing vault knowledge | wiki-query |
| Save a specific conversation result | save |
| Research the public web under a budget | autoresearch |
| Check vault health | wiki-lint |
| Draft a cited glossary or consolidate overlapping notes | wiki-ingest, with an explicitly reviewed scope |
| Roll up log entries | wiki-fold |
| Work with a canvas | canvas |
Query is read-only. Persistence from a query must be an explicit, separately scoped Save operation. Never capture a transcript or update the hot cache merely because a session ended.
Read operation-transactions.md before any custom scaffold or mutation. One logical operation must produce one inspected and recoverable claude-obsidian.transaction.v1 bundle. Parallel agents may return drafts and evidence only; the orchestrator merges them and applies once. Every canonical page create or removal includes an active index or MOC update in that bundle; update the overview only when the stable high-level picture changed. Raw source payloads are create-only. There are no automatic commits.
Use provenance.md when initializing or changing source and claim ledgers. Unsupported evidence stays unsupported; never invent a source, quote, date, locator, or confidence.
After a successful apply, report the operation ID and exact changed paths. If the user explicitly wants a Git checkpoint, run it separately:
python3 "$CORE" checkpoint OPERATION_ID --vault /absolute/path/to/vaultOn a conflict, re-read and rebuild. On interruption, use transaction recover. Reuse an operation ID only with the identical bundle.
Read install-modes.md when installation or host behavior matters. Hooks are optional adapters; portable behavior lives in the core and skills.
Read only the reference needed for the current request:
property schema;
customization;
setup;
integrations;
external read transport;
requests the Local REST API adapter;
consolidation work;
machines;
acceptance evidence;
or recoverable legacy compaction;
pinned external syntax or design references.
changing a generation adapter, or validating host-specific prompting.
Before applying, pause once: observe existing state, verify the vault selection and evidence, then choose the smallest reversible operation that satisfies the request. Afterward, report uncertainty and the next useful improvement without performing it automatically.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.