Static-analysis security audit for your installed community plugins. Flags dangerous APIs, verifies release hashes against GitHub, and scores plugin risk. Fully local — no data leaves your vault.
Static-analysis security audit for your installed Obsidian community plugins.
Obsidian officially cannot sandbox community plugins — every plugin you enable inherits full access to your files, network, and the ability to run shell commands. This plugin scans every installed plugin's bundled main.js for dangerous patterns, verifies its hash against the official GitHub release, and gives each plugin a risk score you can inspect.
Everything runs locally in your vault. The only outbound calls are to api.github.com (to fetch release metadata and asset hashes). Nothing is sent to Ferusnet servers. There is no telemetry, no tracking, and no premium tier.
main.js for ~15 dangerous-API patterns (eval, child_process, remote script loads, mining strings, obfuscated payloads, …).src/constants.ts.isDesktopOnly: true). We hash arbitrary files and need the desktop-only vault adapter.Can it stop malware? No. It flags suspicious patterns and hash mismatches, and it warns you the moment a new plugin is installed. Everything else is your call. If a plugin already installed itself and loaded before this one, static analysis can't retroactively undo what already ran.
GitHub rate limits? The unauthenticated GitHub API allows 60 requests per hour. If you have many plugins installed and want faster refresh, add a fine-grained personal access token in the plugin's settings (read-only, no scopes needed) for 5000/hr.
Does it hide any of my data? No. Every network request is to api.github.com for public metadata. No plugin data, no vault content, no telemetry ever leaves your machine.
MIT © 2026 Ferusnet