Historial de auditorías

Static analysis found network access, environment variable access, documented shell commands, and several weak-crypto heuristics. Review confirms the skill uses a local TaskNotes HTTP API and optional bearer token, while the weak-crypto and prompt-injection signals are false positives. Publication is acceptable with a warning because API credentials are read from .env and sent over plain HTTP to the configured local endpoint.

Standard task management tool with minimal risk. All 89 static findings are false positives. Network calls go exclusively to localhost (Obsidian TaskNotes API), not external endpoints. Environment variables are for local configuration only. No dangerous patterns, data exfiltration, or credential exfiltration detected.

Standard task management tool with minimal risk. All 89 static findings are false positives. Network calls go exclusively to localhost (Obsidian TaskNotes API), not external endpoints. Environment variables are for local configuration only. No dangerous patterns, data exfiltration, or credential exfiltration detected.

Standard task management tool with minimal risk. Only communicates with local Obsidian API on localhost. Reads specific environment variables for configuration. No dangerous patterns or data exfiltration capabilities detected.

Standard task management tool with minimal risk. Only communicates with local Obsidian API on localhost. Reads specific environment variables for configuration. No dangerous patterns or data exfiltration capabilities detected.

Standard task management tool with minimal risk. Only communicates with local Obsidian API on localhost. Reads specific environment variables for configuration. No dangerous patterns or data exfiltration capabilities detected.