Skills obsidian-theme-designer

📦

obsidian-theme-designer

Name: obsidian-theme-designer
Author: XiangyuSu611

Content revision r1 High Risk 📁 Filesystem access⚙️ External commands🌐 Network access

Design Custom Obsidian Themes Visually

Custom Obsidian themes often require trial and error in CSS. This skill guides visual choices, previews results, and creates a usable snippet.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "obsidian-theme-designer" from https://skillstore.io/skills/xiangyusu611-obsidian-theme-designer.md and its manifest at https://skillstore.io/api/skills/xiangyusu611-obsidian-theme-designer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/xiangyusu611-obsidian-theme-designer.md Signed manifest GET /api/skills/xiangyusu611-obsidian-theme-designer/manifest Signed lockfile GET /api/skills/xiangyusu611-obsidian-theme-designer/lockfile

Test it

Using "obsidian-theme-designer". I want a dark academic Obsidian theme for research notes.

Expected outcome:

The skill presents academic, minimal, dark immersive, cyberpunk, and warm texture directions. It then previews dark academic colors and font choices.

Using "obsidian-theme-designer". Make my vault easier to read in Chinese and English.

Expected outcome:

The skill compares bilingual font pairings, shows mixed-language sample notes, and recommends a readable heading, body, and code font set.

Using "obsidian-theme-designer". I approved the preview. Help me install it.

Expected outcome:

The skill prepares a CSS snippet, explains where it belongs in the vault, and lists the Obsidian settings steps to enable it.

Security Audit

High Risk

v5 • 7/8/2026 Open versioned report

Most static findings are false positives from Markdown code fences, inline CSS variables, normal skill installation paths, and reviewed screenshot images. Confirmed risks remain in the font workflow: external curl downloads, shared temp-directory use, PowerShell registry modification, and a relative helper script command. Additional semantic risks include automatic system font installation and reuse of private vault content in generated previews.

Files scanned

406

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:152-181 README.md:37-49 README_CN.md:37-49

Automatic Font Installation Modifies User System

The skill directs the agent to download selected fonts and install them into operating system font locations, including a Windows registry update.

The workflow explicitly says to download and install fonts, and the README advertises automatic font installation. The Windows path includes registry modification, so the system-change intent is clear.

Medium

SKILL.md:45 SKILL.md:148-150

Vault Note Content Reused In Preview Files

The skill tells the agent to scan the vault and use real note content in browser preview files. Private note text may be persisted in generated HTML iterations.

The instructions explicitly require scanning the vault structure and using actual notes for preview text. The persistence risk follows from the instruction to write new preview files for each iteration.

Medium

SKILL.md:64-71

Unbundled Relative Script Execution

The visual companion step runs scripts/start-server.sh from a relative path, but the package file list does not include that script. A relative command may resolve to an unexpected workspace file.

The command path is shown directly in the skill instructions, and the reviewed file structure contains no scripts directory. The risk depends on the runtime working directory, so confidence is high but not absolute.

Capability review items (19)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:177

Shell command substitution

powershell.exe -Command "New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\

The PowerShell command includes command substitution for the font directory and interpolated filenames. It modifies the user font registry and has quoting risk.

High

SKILL.md:177

PowerShell invocation

powershell.exe -Command "New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\

The skill explicitly invokes powershell.exe to create a registry property under the Windows fonts key. Registry modification is a high-risk system change.

Medium

SKILL.md:67-70

Ruby/shell backtick execution

```bash

The fenced block instructs running scripts/start-server.sh from a relative path. Because the reviewed package has no bundled scripts directory, this could execute an unexpected workspace script.

Medium

SKILL.md:70-71

Ruby/shell backtick execution

```

This closes the same bash block that runs a relative start-server.sh helper. The risk is command confusion from an unbundled relative script path.

Medium

SKILL.md:157-166

Ruby/shell backtick execution

```bash

The bash block downloads font CSS and font files from the network. Even though the fence marker is not Ruby syntax, the enclosed shell workflow is a real external-command risk.

Medium

SKILL.md:166-170

Ruby/shell backtick execution

```

This closes the same bash block that fetches remote font URLs and writes them into /tmp/fonts. The security concern is the enclosed command sequence.

Medium

SKILL.md:170

Ruby/shell backtick execution

- **Windows:** Copy `.ttf` files to `$HOME/AppData/Local/Microsoft/Windows/Fonts/` and register in r

The line directs copying fonts into a Windows user font directory and registering them. This is a user-system modification workflow that should require explicit confirmation.

Medium

SKILL.md:171-179

Ruby/shell backtick execution

```bash

The fenced bash block copies downloaded fonts and writes Windows registry entries through PowerShell. That is a real external-command and system-configuration risk.

Medium

SKILL.md:179-180

Ruby/shell backtick execution

```

This closes the same risky installation block that performs file copies and registry modification. The block should not run automatically from a marketplace skill.

Medium

SKILL.md:159-160

Shell command substitution

CSS=$(curl -s "https://fonts.googleapis.com/css2?family=FontName:wght@400;600;700" \

The command captures a curl response from Google Fonts into a shell variable. Remote content is then parsed for downloads, so this external command should be gated.

Medium

SKILL.md:164

Shell command substitution

curl -sL "$url" -o "/tmp/fonts/$(basename "$url")"

The command downloads each extracted URL into a shared /tmp/fonts directory using a derived filename. This combines remote input, filesystem writes, and shell expansion.

Medium

SKILL.md:176

Shell command substitution

fname=$(basename "$f")

The filename is derived from files in /tmp/fonts and then used in the PowerShell registry command. This is not sufficient validation for registry value creation.

Medium

SKILL.md:157-166

Template literal with command substitution

```bash

The bash block uses command substitution with curl output to drive later downloads. That is real shell behavior sourced from a network response.

Medium

SKILL.md:171-179

Template literal with command substitution

```bash

The installation block uses shell variables and command substitution while copying fonts and writing registry values. This should require manual review before execution.

Medium

SKILL.md:164

Temp directory access

curl -sL "$url" -o "/tmp/fonts/$(basename "$url")"

The command writes downloaded remote files into /tmp/fonts. A fixed shared temp path can collide with existing files and should be replaced with a unique temp directory.

Medium

SKILL.md:173

Temp directory access

cp /tmp/fonts/*.ttf "$FONTDIR/"

The command copies all TTF files from /tmp/fonts into the Windows font directory. This trusts a shared temp directory as the install source.

Medium

SKILL.md:175

Temp directory access

for f in /tmp/fonts/*.ttf; do

The loop iterates over all TTF files in /tmp/fonts before registry registration. A shared temp directory is not a safe trust boundary for installation.

Low

SKILL.md:159

Hardcoded URL

CSS=$(curl -s "https://fonts.googleapis.com/css2?family=FontName:wght@400;600;700" \

The command fetches CSS from fonts.googleapis.com during the workflow. The domain is legitimate, but it is an external network request that drives local installation.

Low

SKILL.md:163

Hardcoded URL

echo "$CSS" | grep -o 'https://[^)]*' | while read url; do

The workflow extracts https URLs from downloaded CSS and fetches each referenced font. This expands network access beyond a single visible URL.

Risk Factors

📁 Filesystem access (9)

README_CN.md:56 README_CN.md:56 README.md:56 README.md:56 SKILL.md:181 SKILL.md:181 SKILL.md:164 SKILL.md:173 SKILL.md:175

⚙️ External commands (40)

🌐 Network access (2)

SKILL.md:159 SKILL.md:163

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/xiangyusu611-obsidian-theme-designer/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/xiangyusu611-obsidian-theme-designer/security.svg)](https://skillstore.io/skills/xiangyusu611-obsidian-theme-designer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/xiangyusu611-obsidian-theme-designer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiangyusu611-obsidian-theme-designer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/xiangyusu611-obsidian-theme-designer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

XiangyuSu611. (2026). obsidian-theme-designer security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/xiangyusu611-obsidian-theme-designer/audits/5

BibTeX citation

@techreport{xiangyusu611-xiangyusu611-obsidian-theme-designer-2026,
  author = {XiangyuSu611},
  title = {obsidian-theme-designer security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/xiangyusu611-obsidian-theme-designer/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "obsidian-theme-designer security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "XiangyuSu611"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xiangyusu611-obsidian-theme-designer/audits/5"
identifiers:
  - type: other
    value: "skillstore:xiangyusu611-obsidian-theme-designer:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Personal Vault Refresh

Create a cleaner light and dark theme for daily notes, projects, and reading workflows.

Research Workspace Styling

Design an academic look with readable typography, tables, blockquotes, and mixed Chinese and English content.

Team Theme Prototype

Preview several visual directions before sharing a consistent CSS snippet with collaborators.

Try These Prompts

Start A Simple Theme

Design my Obsidian theme. Please ask me simple questions and show visual options before creating the CSS snippet.

Match A Visual Reference

Use this reference image as the design direction for my Obsidian theme. Keep it readable in light and dark modes.

Tune Fonts And Colors

Create three Obsidian theme variants with different font pairings and color palettes. Include Chinese and English preview text.

Build A Complete Snippet

Analyze my vault appearance, preview the final design, then generate an Obsidian CSS snippet with import instructions.

Best Practices

Share a reference image or app style before choosing colors and fonts.
Review previews in both light and dark modes before approving the snippet.
Inspect any font installation command before allowing system changes.

Avoid

Do not approve a CSS snippet before seeing a full vault-style preview.
Do not use private note content in demos unless you are comfortable storing it in preview files.
Do not run font installation commands without checking the source and destination paths.