# Add to your Claude Code skills
git clone https://github.com/benoror/obsidianos_workGuides for using ai agents skills like obsidianos_work.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "simple-git: simple-git is vulnerable to Remote Code Execution",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tar: tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"severity": "high"
},
{
"type": "npm-audit",
"message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-05-30T16:00:07.799Z",
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
An Obsidian vault wired with AI agent skills — an Agentic Operating System for Thinkers.
Slash commands that run inside your vault, powered by any AI agent:
/meeting → Create notes from Google Calendar
/cache-notes → Embed AI meeting transcripts
/fill-participants → Resolve names to [[@Person]] wikilinks
/followup-todos → Extract action items as plain markdown bullets (no Tasks checkboxes)
/note-status → Verify notes are fully processed
/recap → Weekly summary from email, Slack, Jira & vault
/commit → Stage & commit with inferred intent
/sync-upstream-obsidianos → Pull updates from upstream ObsidianOS
Agent-agnostic — works with Cursor, Claude Code, OpenCode, or any MCP-compatible client. Clone it, fill in USER.md, and go.
| Agent | Support level | Notes |
|---|---|---|
| Cursor IDE | Full | Loads .cursor/rules/ and .cursor/mcp.json automatically |
Cursor CLI (cursor) |
Full | Same engine in background/headless mode |
| Claude Code | Full | Reads AGENTS.md + CLAUDE.md natively; see CLAUDE.md for QMD MCP setup |
| OpenCode / Crush | Full | Reads OpenCode.md; see OpenCode.md for QMD MCP setup |
| OpenClaw | Full | Workspace skills in skills/ (symlink to .agents/skills/); config in ~/.openclaw/openclaw.json |
| Other MCP-compatible clients | Partial | Can use the QMD MCP server; agent instructions won't auto-load |
| Skill | What it does |
|---|---|
/meeting |
Create or wrap up meeting notes (from Google Calendar or manual) |
/cache-notes |
Fetch & embed AI meeting transcripts as Obsidian callouts |
/fill-participants |
Resolve names in notes to [[@Person]] wikilinks |
/followup-todos |
Extract action items as plain markdown bullets (no Tasks checkboxes) |
/recap |
Weekly recap from emails, Slack, Jira, and vault notes |
/note-status |
Verify meeting notes are fully processed (Notes, Cache, Participants, Todos) |
/commit |
Stage and commit — accepts file/folder scope, free-text intent, or amend |
/sync-upstream-obsidianos |
Pull structural updates from upstream ObsidianOS |
defuddle |
Clean markdown from URLs via Defuddle CLI |
json-canvas |
JSON Canvas (.canvas) authoring |
obsidian-bases |
Obsidian Bases (.base) views, filters, formulas |
obsidian-cli |
Vault operations via the obsidian CLI (Obsidian must be running) |
obsidian-markdown |
Obsidian Flavored Markdown conventions |
Each skill supports multiple sub-commands and arguments — see AGENTS.md for the full reference. Skill proxies: .cursor/skills, .claude/skills, .opencode/skills, and repo-root skills/ are symlinks to .agents/skills/ so Cursor, Claude Code, OpenCode, and OpenClaw share one canonical tree.
gws) — optional; required for /meeting (Calendar), /cache-notes / /fill-participants (Docs/Drive), and /recap (Gmail/Calendar). Install per § 3 in Setup below.git clone https://github.com/youruser/obsos_work.git
cd obsos_work
npm install
Edit USER.md with your name, email, timezone, and aliases. This is the single source of truth that all skills reference — no other file needs your personal info.
Required for /meeting (list today’s Calendar events), /cache-notes / /fill-participants (read Gemini Google Docs), and /recap (Gmail + Calendar). All of these workflows are read-only; use OAuth scopes limited to what you need (e.g. Drive/Docs/Calendar/Gmail readonly).
gws — pick one:
brew install googleworkspace-clinpm install -g @googleworkspace/cligws auth login
Use a scope preset or --scopes that includes readonly access for the APIs you use. Credentials are stored under ~/.config/gws/ by default. Optional env vars: see .env.example and the upstream README.
[!NOTE] Google Workspace is not exposed via MCP in this vault — agents run
gwsin the terminal. Cursor still loads QMD from.cursor/mcp.jsononly.
Required for /recap and vault-wide search. QMD indexes your markdown files for keyword and semantic search.
npx qmd collection add . --name my_vault
npx qmd embed
The npx qmd mcp server (configured in .cursor/mcp.json) will serve searches from this index. Re-run npx qmd embed after adding significant new content.
The vault ships with these directories already in place:
Meetings/ Meeting notes (create subfolders per team/project as needed)
Teams/People/ Person files: @Name.md (one per colleague)
Teams/ Team files: +TeamName.md
Templates/ Obsidian templates
A default Teams/People/@Me.md is included as the vault owner's person file. Add subfolders under Meetings/ to organise notes by team or project (e.g. Meetings/Eng/, Meetings/TBs/).
Open the vault folder in both Obsidian (for viewing/editing notes) and Cursor (for running agent skills). Cursor will auto-load MCP servers from .cursor/mcp.json (this repo ships QMD only) and the rules from .cursor/rules/. Install and log in to gws separately for Google Workspace features.
In Obsidian, hide non-vault folders from the file explorer: go to Settings → Files & Links → Excluded files and add node_modules.
The vault works with vanilla Obsidian, but these community plugins power specific features. Install whichever you need from Settings → Community plugins → Browse.
| Plugin | ID | Used by |
|---|---|---|
| Tasks | obsidian-tasks-plugin |
ToDo's.md queries, task checkboxes & priorities elsewhere in the vault |
| Update modified date | frontmatter-modified-date |
Auto-updates modified: in YAML frontmatter when you edit a note |
| Plugin | ID | What it adds |
|---|---|---|
| Natural Language Dates | nldates-obsidian |
Type @today or @next Monday to insert date links — handy for task due dates |
| Calendar | calendar |
Sidebar calendar widget for navigating daily/meeting notes by date |
| Dataview | dataview |
Query engine for vault data — tables, lists, and tasks from frontmatter and inline fields |
| Open Tab Settings | open-tab-settings |
Tab deduplication and placement control — prevents the same note from opening twice |
These are not required by any skill but improve the day-to-day experience:
| Plugin | ID | What it adds |
|---|---|---|
| Obsidian Git | obsidian-git |
Auto-backup vault to git on a schedule (alternative to /commit) |
| Auto Card Link | auto-card-link |
Paste a URL and get a rich preview card |
| File Explorer Note Count | file-explorer-note-count |
Shows note count badges on folders |
| Icon Folder | obsidian-icon-folder |
Custom icons on folders and files in the explorer |
| Custom File Explorer Sorting | custom-sort |
Manual sorting rules for files and folders in the explorer |
| Cycle Through Panes | cycle-through-panes |
Ctrl/Cmd+Tab to cycle through open tabs like a browser |
These line up with the bundled kepano/obsidian-skills agent skills (obsidian-cli, json-canvas, obsidian-bases, obsidian-markdown). None are extra Community plugins unless noted — turn on the features you use, and keep Obsidian running when an agent drives the vault via the [Obsidian CLI](htt