CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

22.4 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 3 flagged

Securityscore 64 · 3 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .github/agents/improvement-intake-agent.agent.md×3

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerpt.github/agents/improvement-intake-agent.agent.md· markdown

45Read the response carefully. Extract everything you can before asking follow-ups.

46Do not ask for information already given.

48---

Occurrences

3 occurrences · first at L46, also L53, L280

Show all 3 locations

Line

File

L46

.github/agents/improvement-intake-agent.agent.md

L53

.github/agents/improvement-intake-agent.agent.md

L280

.github/agents/improvement-intake-agent.agent.md

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/obsidian-wiki-engine/skills/obsidian-init/SKILL.md · 1 file

plugins/obsidian-wiki-engine/skills/obsidian-init/SKILL.md7.2 KB · Markdown

name: obsidian-init

plugin: obsidian-wiki-engine

description: "Initialize and onboard a new project repository as an Obsidian Vault. Covers prerequisite installation, vault configuration, exclusion filters, and validation. Use when setting up Obsidian for the first time in a project."

allowed-tools: Bash, Read, Write

Dependencies

This skill requires Python 3.8+ and standard library only. No external packages needed.

To install this skill's dependencies:

pip-compile ./requirements.in
pip install -r ./requirements.txt

See ./requirements.txt for the dependency lockfile (currently empty — standard library only).

Obsidian Init (Vault Onboarding)

Status: Active Author: Richard Fremmerlid Domain: Obsidian Integration

Purpose

This skill is the entry point for any project adopting Obsidian. It handles:

Verifying (and guiding installation of) prerequisites
Initializing the vault configuration
Setting up exclusion filters
Validating the vault is ready for agent operations

Phase 1: Prerequisites Installation

1.1 Obsidian Desktop Application (Required)

The Obsidian desktop app must be installed on the host machine. It is the visual interface for browsing, editing, and viewing the Graph and Canvas.

macOS (Homebrew):

brew install --cask obsidian

Manual Download:

https://obsidian.md/download

Verify:

ls /Applications/Obsidian.app

1.2 Obsidian CLI v1.12+ (Recommended)

The official CLI communicates with a running Obsidian instance via IPC singleton lock. It enables programmatic vault operations (read, search, backlinks, properties).

npm (global install):

npm install -g obsidian-cli

Verify:

obsidian --version

Note: The CLI requires an active Obsidian Desktop instance to communicate with. It operates in "silent" mode by default. For headless/CI environments where Obsidian is not running, our vault_ops.py (from obsidian-vault-crud) handles direct filesystem operations without requiring the CLI.

1.3 ruamel.yaml (Required for CRUD Operations)

Lossless YAML frontmatter handling requires ruamel.yaml:

pip install ruamel.yaml

1.4 Optional Community Plugins

For advanced vault features, install these from within the Obsidian app:

Plugin	Purpose	Required For
Dataview	Database-style queries over frontmatter	Structured metadata queries
Canvas (built-in)	Visual boards with JSON Canvas spec	`obsidian-canvas-architect` skill
Bases	Table/grid/card views from YAML	`obsidian-bases-manager` skill

Phase 2: Vault Initialization

Interactive Init

python ./init_vault.py --vault-root <path>

With Custom Exclusions

python ./init_vault.py \
  --vault-root <path> \
  --exclude "custom_dir/" "*.tmp"

Validate Only (No Changes)

python ./init_vault.py --vault-root <path> --validate-only

What It Does

Validates the target directory exists and contains .md files
Creates the .obsidian/ configuration directory (if not present)
Writes app.json with sensible exclusion filters for developer repos
Updates .gitignore to exclude .obsidian/ (user-specific config)
Reports next steps for opening the vault in the Obsidian app

Phase 3: Exclusion Configuration

Default Exclusions

Pattern	Reason
`node_modules/`	NPM dependencies
`.worktrees/`	Git worktree isolation
`.vector_data/`	ChromaDB binary data
`.git/`	Git internals
`venv/`	Python virtual environments
`__pycache__/`	Python bytecode cache
`*.json`	Data/config files (not knowledge)
`*.jsonl`	Export payloads
`learning_package_snapshot.md`	Machine-generated bundle
`bootstrap_packet.md`	Machine-generated bundle
`learning_debrief.md`	Machine-generated bundle
`*_packet.md`	Audit/review bundles
`*_digest.md`	Context digests
`dataset_package/`	Export artifacts

Why Exclude Machine-Generated Files?

These are giant concatenated snapshots produced by bundler/distiller scripts. Indexing them in Obsidian would pollute the graph with thousands of false backlinks pointing into machine-generated text, not human-authored knowledge.

Phase 4: Post-Init Steps

Open Obsidian → Click "Open Folder as Vault" → Select vault root
Verify indexing → Check that 01_PROTOCOLS/, ADRs/, etc. appear in sidebar
Test wikilinks → Click any [[link]] to confirm navigation works
Set VAULT_PATH → export VAULT_PATH=/path/to/vault

Phase 5: Wiki Engine Initialization (Guided Discovery Sub-Agent)

After the vault is initialized, you can optionally initialize the LLM Wiki Engine layer. This creates a wiki_sources.json manifest — the multi-source registry that tells the wiki engine which raw content folders to index.

This is the wiki equivalent of rlm_profiles.json in the RLM system. Each named entry in wiki_sources.json is a raw content directory that will be parsed into Karpathy-style wiki nodes. No files are moved.

5.1 Run the Guided Discovery Sub-Agent

The sub-agent interviews you interactively to register your raw content directories:

/wiki-init

Or directly:

python ./scripts/raw_manifest.py --init --wiki-root /path/to/wiki-root

5.2 What the Sub-Agent Asks

For each source folder you want to index, it asks:

Question	Example Answer
Wiki root path?	`/path/to/vault/wiki-root`
Source folder path?	`/path/to/vault/notes`
Label for this source?	`daily-notes`
File extensions?	`.md` (default)
Subdirectories to exclude?	`_archive, *.tmp`
Add another source?	yes/no

5.3 Output: `rlm_wiki_raw_sources_manifest.json`

Uses the same flat schema as rlm-factory and vector-db for consistency:

{
  "description": "Source raw content for Obsidian Wiki",
  "include": [
    "plugins/",
    "plugin-research/"
  ],
  "exclude": [
    ".git/",
    "node_modules/",
    ".venv/",
    "__pycache__/"
  ],
  "recursive": true
}

Saved to: .agent/learning/rlm_wiki_raw_sources_manifest.json

5.4 Next Steps After Discovery

/wiki-ingest    <- parse all registered sources, build wiki nodes
/wiki-distill   <- generate RLM summaries (cheapest available LLM CLI)
/wiki-query     <- start querying the wiki

Portability Note

This skill is project-agnostic. It works on any Git repository with markdown files. The exclusion filters are sensible defaults for developer projects. When reusing this plugin in other projects, simply run the init script with the new project's root path.

Quick Reference: Full Install Sequence

# 1. Install prerequisites
brew install --cask obsidian        # Desktop app
npm install -g obsidian-cli         # CLI tools
pip install ruamel.yaml             # Lossless YAML

# 2. Initialize vault
python ./init_vault.py \
  --vault-root /path/to/your/project

# 3. Set environment variable
export VAULT_PATH=/path/to/your/project

# 4. Open in Obsidian app
open /Applications/Obsidian.app

obsidian-init— agent skill

Is obsidian-init safe to install?

Dependencies

Obsidian Init (Vault Onboarding)

Purpose

Phase 1: Prerequisites Installation

1.1 Obsidian Desktop Application (Required)

1.2 Obsidian CLI v1.12+ (Recommended)

1.3 ruamel.yaml (Required for CRUD Operations)

1.4 Optional Community Plugins

Phase 2: Vault Initialization

Interactive Init

With Custom Exclusions

Validate Only (No Changes)

What It Does

Phase 3: Exclusion Configuration

Default Exclusions

Why Exclude Machine-Generated Files?

Phase 4: Post-Init Steps

Phase 5: Wiki Engine Initialization (Guided Discovery Sub-Agent)

5.1 Run the Guided Discovery Sub-Agent

5.2 What the Sub-Agent Asks

5.3 Output: `rlm_wiki_raw_sources_manifest.json`

5.4 Next Steps After Discovery

Portability Note

Quick Reference: Full Install Sequence

Audit the pieces. Scan the whole. Decide.

Is obsidian-init safe to install?

Dependencies

Obsidian Init (Vault Onboarding)

Purpose

Phase 1: Prerequisites Installation

1.1 Obsidian Desktop Application (Required)

1.2 Obsidian CLI v1.12+ (Recommended)

1.3 ruamel.yaml (Required for CRUD Operations)

1.4 Optional Community Plugins

Phase 2: Vault Initialization

Interactive Init

With Custom Exclusions

Validate Only (No Changes)

What It Does

Phase 3: Exclusion Configuration

Default Exclusions

Why Exclude Machine-Generated Files?

Phase 4: Post-Init Steps

Phase 5: Wiki Engine Initialization (Guided Discovery Sub-Agent)

5.1 Run the Guided Discovery Sub-Agent

5.2 What the Sub-Agent Asks

5.3 Output: rlm_wiki_raw_sources_manifest.json

5.4 Next Steps After Discovery

Portability Note

Quick Reference: Full Install Sequence

Audit the pieces. Scan the whole. Decide.

5.3 Output: `rlm_wiki_raw_sources_manifest.json`