Agent skill · security · jeremylongshore
obsidian-security-basics
Implement secure Obsidian plugin development practices. Covers credential
Why this skill is useful
Provides specific security practices and code examples for developing secure Obsidian plugins, which the AI wouldn't reliably generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Obsidian Security Basics Overview Security practices for Obsidian plugin development. Plugins run with full vault filesystem access and can make arbitrary network requests inside Electron. Responsible development requires protecting credentials, sanitizing external data, validating URI handlers, minimizing permissions, and following Obsidian's plugin guidelines to avoid community submission rejection. Prerequisites Obsidian plugin development environment Understanding that .obsidian/plugins/<id>/data.json is synced by cloud services Awareness of Obsidian Plugin Guidelines Instructions Step 1: Credential Storage — Never in data.json Plugin settings (data.json) live inside the vault and are synced by iCloud, Dropbox, Obsidian Sync, and Git. API keys stored here are effectively public. Step 2: Input Validation and XSS Prevention Data from HTTP responses, clipboard, or URI handlers must be sanitized before rendering. Step 3: Secure URI Handler Registration Obsidian's registerObsidianProtocolHandler lets external apps trigger plugin actions via obsidian:// URIs. Validate all parameters. Step 4: Secure Network Requests Step 5: Permission Minimization Step 6: Plugin Review Rejection Checklist Obsidian's plugin review team will reject plugins for these violations: Output SecureStorage class using Electron's safeStorage for encrypted credential storage HTML and markdown sanitization for all external content URI handler with action whitelist and path validation Secure network request wrapper with HTTPS enforcement and domain allowlist Platform-specific guards for desktop/mobile code paths Plugin review rejection checklist with approved alternatives Error Handling Issue Cause Solution ------- ------- ---------- API key synced to cloud Stored in data.json Use SecureStorage with Electron safeStorage XSS in note preview Unsanitized external HTML Use createEl with text property, or sanitizeHtml Directory traversal via URI Unvalidated path parameter Strip .., normalize, validate wi …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/obsidian-security-basics