wiki-retrieve — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wiki-retrieve (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This extension derives search data from wiki/ into .vault-meta/. It never changes canonical notes. Always pass the selected vault explicitly.
Resolve the installed product root from this skill's own location, not from the vault or current working directory:
PRODUCT_ROOT=/absolute/path/to/installed/claude-obsidian
PREFIX="$PRODUCT_ROOT/scripts/contextual-prefix.py"
BM25="$PRODUCT_ROOT/scripts/bm25-index.py"
RETRIEVE="$PRODUCT_ROOT/scripts/retrieve.py"
RERANK="$PRODUCT_ROOT/scripts/rerank.py"
test -f "$PREFIX" && test -f "$BM25" && test -f "$RETRIEVE" && test -f "$RERANK"contextual-prefix.py splits pages on paragraph boundaries and stores theraw chunk plus a short page-level prefix.
bm25-index.py builds a local, standard-library BM25 index over thecontextualized text.
retrieve.py selects BM25 candidates, optionally reranks them, rejectsinvalid records, deduplicates by page, and returns paths and snippets.
is not itself evidence.
Preview first, then build synthetic prefixes without network egress:
python3 "$PREFIX" --vault "$VAULT" --all --no-llm --peek
python3 "$PREFIX" --vault "$VAULT" --all --no-llm
python3 "$BM25" --vault "$VAULT" build
python3 "$RETRIEVE" --vault "$VAULT" "wiki" --top 1 --no-rerank --explainChunk and index files are disposable runtime state. Incremental prefixing skips records whose chunk hashes, page hashes and provider/model profile still match. Legacy records without that profile regenerate on an explicit build. A complete scan removes surplus records for deleted pages, and the prefixer invalidates the BM25 index before changing its chunk set so a mixed stale index is not served. Prefix and BM25 build operations share the vault-wide mutation lock with every other writer; a busy vault fails closed instead of publishing a partial index.
Synthetic prefixes use only local frontmatter and page text. The explicit Anthropic API profile can send page bodies off-machine and requires the user's consent plus --allow-egress and a configured API key. There is no Claude CLI generation tier or ambient subprocess fallback. Never infer consent from an API key or installed binary. Preview the scope first and state which provider will receive what data.
Remote Ollama endpoints also require explicit approval and --allow-remote-ollama; the default reranker accepts localhost only.
Local model prefixes are a separate explicit option. Use an already installed exact name:tag; no server is started and no model is installed or pulled:
python3 "$PREFIX" --vault "$VAULT" --all --local-ollama --ollama-model installed:tag --peek
python3 "$PREFIX" --vault "$VAULT" --all --local-ollama --ollama-model installed:tagThe prefix adapter verifies cloud-disabled server status and local model identity before sending page text. Unsupported or unavailable preflight falls back to synthetic prefixes for new or changed chunks only; prefixes from the same endpoint and model stay in place, so a transient outage leaves an unchanged vault's chunks and BM25 index untouched. This requirement can exclude older Ollama servers. Reranking and tiling use the same local-only proof before query, page, chunk, or embedding cache work. --allow-remote-ollama approves the endpoint, not cloud delegation by the server. See prefix providers for the exact policy, cloud model selection and verification limits. The reranker has its own model and endpoint policy; selecting local prefixes does not enable reranking.
For a strictly read-only lookup, use the prebuilt BM25 index:
python3 "$RETRIEVE" --vault "$VAULT" "$QUERY" --top 5 --no-rerank --explainFor an explicitly requested rerank, omit --no-rerank. The default is Ollama's multilingual nomic-embed-text-v2-moe model (approximately 958 MB); the product never pulls it automatically. To use an already-installed, smaller, English-oriented v1.5 model, pass --model nomic-embed-text explicitly. Nomic models use search_query: for the query and search_document: for candidate text. Nomic v2 has a 512-token input context and Ollama truncates longer embedding inputs by default; BM25 still scores the complete chunk. Embeddings are cached by exact model, verified digest, input scheme, and hash of the exact prefixed input. A missing local Ollama service, malformed HTTP reply, missing selected model, unusable vector, or any candidate embedding failure falls back for the complete result set to the original BM25 order; it never mixes cosine and BM25 score scales.
Query input is bounded at 8,000 normalized characters and result counts must be between 1 and 1,000. Oversized queries and invalid limits fail with an actionable usage error instead of looking like an empty successful search. An untagged model request matches only the installed untagged name or its :latest alias; select any other tag explicitly.
Use direct diagnostics when needed:
python3 "$BM25" --vault "$VAULT" stats
python3 "$BM25" --vault "$VAULT" query "$QUERY" --top 10
python3 "$RERANK" --vault "$VAULT" "$QUERY" --peek
python3 "$RERANK" --vault "$VAULT" "$QUERY" --model nomic-embed-text --peek$VAULT/.vault-meta/chunks/ and $VAULT/wiki/ respectively.
hashes to match before a cached record can be built or served.
changed page hashes, and stale index/chunk hash pairs.
--top.retrieve.py exit 10 with a stable rebuild command; callers fall back to the standard vault query/text-search path and do not fabricate matches.
benchmark produced them.
Measure a prebuilt index against explicit labels with bench --queries FILE --vault VAULT. See offline retrieval evaluation for recall, MRR, missing labels and negative cases. This is a read-only measurement and never silently rebuilds an index or calls a model.
Observe cache readiness and privacy boundaries, think about whether lexical or semantic ranking is needed, verify returned paths and source freshness, and grow by measuring retrieval misses against a maintained local query set.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.