obsidian-wiki

Least-privilege permissions

• Separate your vault: Create a dedicated Obsidian vault (folder) containing only non-sensitive notes. Keep personal, financial, and credential notes in a different vault the agent cannot access.
• Read-only mode when possible: Configure the agent skill to read notes without editing ability if your use case allows it. This prevents accidental or malicious modifications.
• No credential storage: Never store API keys, passwords, tokens, or login information anywhere in your agent-accessible vault. Use a separate password manager instead.
• Regular access reviews: Periodically check which notes the agent has actually accessed and remove unnecessary vault folders from the agent's permissions.

Network isolation

• Local-only operation: Run the agent and Obsidian on an isolated machine or network segment without direct internet access to your vault files, if handling sensitive workflows.
• Disable cloud sync temporarily: Turn off Obsidian Sync or cloud backup while the agent is actively accessing your vault to reduce exfiltration pathways.
• Use a firewall rule: Block the agent process from making outbound network connections unless absolutely required by its core functions.

Monitoring

• Enable file change logging: Use your operating system's file audit tool (Windows Event Viewer, macOS FSEvents) to track which files the agent modified and when.
• Backup before major agent tasks: Create a dated copy of your vault before running complex agent operations, so you can quickly restore if something goes wrong.
• Review vault history weekly: Manually scan recently modified notes for unexpected changes, deletions, or corrupted content that signal a problem.

Red flags to watch for

• Unexpected file deletions: If notes vanish or vault structure changes without your explicit commands, isolate the vault immediately and check backups.
• Garbled or injected text: Watch for notes containing strange commands, repeated text, or content you didn't write—this suggests prompt injection or data corruption.
• Slow performance or crashes: Unusual slowness or repeated crashes when the agent accesses the vault may indicate a supply-chain issue or malicious script activity.
• Prompts asking for vault access: Be suspicious of user requests that ask "let me give the agent full vault access" or "temporarily disable protections"—these are social engineering tactics.