Skills bases
📦

bases

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access

Query Obsidian Bases from Local RPC

Obsidian Bases can hold useful project and note metadata, but querying them manually is slow. This skill gives Claude, Codex, and Claude Code focused prompts for listing bases, querying views, and reading schemas through the local plugin RPC.

Supports: Claude Codex Code(CC)
⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "bases" from https://skillstore.io/skills/artemxtech-bases.md and its manifest at https://skillstore.io/api/skills/artemxtech-bases/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/artemxtech-bases.md Signed manifest GET /api/skills/artemxtech-bases/manifest Signed lockfile GET /api/skills/artemxtech-bases/lockfile

Test it

Using "bases". List all bases in my vault.

Expected outcome:

A short list of base names, each with its vault path when available.

Using "bases". Query my active projects view.

Expected outcome:

A concise table-style summary with note names, statuses, dates, and paths.

Using "bases". Show fields for my reading list base.

Expected outcome:

A field inventory with names, likely meanings, and suggestions for useful filters.

Security Audit

Medium Risk
v9 • 7/5/2026 Open versioned report

The Markdown code fence detections for Ruby backtick execution are false positives. The skill does instruct requests to a loopback Obsidian RPC service, which can expose vault metadata and should require user awareness. No prompt injection or remote exfiltration instructions were found.

1
Files scanned
65
Lines analyzed
8
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
SKILL.md:2-3SKILL.md:36-46
Local Obsidian Vault Data Access
The skill directs the agent to query a local Obsidian Bases RPC service and shows note paths and frontmatter in results. This can expose private vault data without clear consent.
The skill description and response example show Obsidian base queries returning note paths and metadata. No remote exfiltration is shown, so the risk is local privacy scope.
Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:12
Hardcoded IP address
`http://127.0.0.1:27125/rpc`
The hardcoded 127.0.0.1 address targets a local RPC service that may expose Obsidian data. Loopback scope reduces risk but does not remove the data access concern.
Medium
SKILL.md:18
Hardcoded IP address
curl -s -X POST http://127.0.0.1:27125/rpc \
The curl command uses the hardcoded 127.0.0.1 RPC address. This is local-only, but it can retrieve vault data through the plugin.
Medium
SKILL.md:24
Hardcoded IP address
curl -s -X POST http://127.0.0.1:27125/rpc \
The query command uses the hardcoded 127.0.0.1 RPC address. This is local-only, but it can retrieve a base view from the vault.
Medium
SKILL.md:30
Hardcoded IP address
curl -s -X POST http://127.0.0.1:27125/rpc \
The schema command uses the hardcoded 127.0.0.1 RPC address. This is local-only, but it can expose field names from a vault base.
Low
SKILL.md:12
Hardcoded URL
`http://127.0.0.1:27125/rpc`
The skill documents a fixed loopback RPC endpoint for Obsidian data access. It is local, but agent-driven requests can expose vault metadata.
Low
SKILL.md:18
Hardcoded URL
curl -s -X POST http://127.0.0.1:27125/rpc \
The curl example posts to the fixed loopback RPC endpoint. The destination is local, but the request can return Obsidian vault data.
Low
SKILL.md:24
Hardcoded URL
curl -s -X POST http://127.0.0.1:27125/rpc \
The query example posts to the fixed loopback RPC endpoint. The endpoint is local, but it can read structured vault data.
Low
SKILL.md:30
Hardcoded URL
curl -s -X POST http://127.0.0.1:27125/rpc \
The schema example posts to the fixed loopback RPC endpoint. The endpoint is local, but it can reveal base fields and metadata.

Risk Factors

⚙️ External commands (11)
SKILL.md:12 SKILL.md:17-20 SKILL.md:20-23 SKILL.md:23-26 SKILL.md:26-29 SKILL.md:29-32 SKILL.md:32-36 SKILL.md:36-50 SKILL.md:50-54 SKILL.md:54-60 SKILL.md:60-64
🌐 Network access (9)
SKILL.md:12 SKILL.md:18 SKILL.md:24 SKILL.md:30 SKILL.md:64 SKILL.md:12 SKILL.md:18 SKILL.md:24 SKILL.md:30
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/artemxtech-bases/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/artemxtech-bases/security.svg)](https://skillstore.io/skills/artemxtech-bases?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/artemxtech-bases?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/artemxtech-bases/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/artemxtech-bases.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

ArtemXTech. (2026). bases security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/artemxtech-bases/audits/9

BibTeX citation

@techreport{artemxtech-artemxtech-bases-2026, author = {ArtemXTech}, title = {bases security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/artemxtech-bases/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "bases security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "ArtemXTech" date-released: "2026-07-05" url: "https://skillstore.io/skills/artemxtech-bases/audits/9" identifiers: - type: other value: "skillstore:artemxtech-bases:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
85
Content
70
Community
83
Spec Compliance

What You Can Build

Inspect note databases

Product managers can list bases and check current view names before planning updates.

Review project metadata

Researchers can query a base view to compare statuses, dates, and note paths.

Build data extraction prompts

Developers can discover schemas before creating repeatable vault reporting workflows.

Try These Prompts

List my bases 
Use the bases skill to list available Obsidian Bases from the local RPC endpoint. Show only base names and paths.
Query a view 
Query the base at [base path] and view [view name]. Summarize row names, paths, and important frontmatter fields.
Discover schema fields 
Get the schema for [base path] and [view name]. Explain each available field and suggest fields for a report.
Compare filtered results 
Query [base path] view [view name], extract [fields], and compare rows by [status or date]. Ask before reading another base.

Best Practices

  • Confirm the base path and view name before querying.
  • Review returned note paths and metadata before sharing them outside the vault.
  • Keep the Obsidian RPC plugin bound to localhost.

Avoid

  • Do not query broad vault views when a focused base or view is enough.
  • Do not expose the local RPC port beyond the local machine.
  • Do not paste sensitive results into external services without approval.

Frequently Asked Questions

What plugin does this skill use?
It uses the Bases Query plugin for Obsidian through its local RPC endpoint.
Can it install the plugin for me?
No. It only documents the plugin source and assumes installation is handled separately.
Does it send data to the internet?
The documented queries target localhost. Results may still contain private vault data.
What data can it return?
It can return base rows, note paths, names, frontmatter values, and schema fields.
Can I use it with Codex?
Yes. The prompt guidance supports Claude, Codex, and Claude Code workflows.
What should I confirm before running it?
Confirm the Obsidian app is open, the plugin is enabled, and the target base and view are correct.

Developer Details

Author

ArtemXTech

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/ArtemXTech/personal-os-skills/tree/main/skills/bases

Ref

6eec4a59f63ff83440a84c18d1aef79743bc714e

Maintenance freshness

7/18/2026

Usage

7 downloads · 230 views

File structure

📄 SKILL.md

More from ArtemXTech

View all

Related Skills

View all