on":"0.1.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-12T16:28:54.000Z","releaseDate":"2026-06-04T09:46:35.000Z","artifactStatus":"verified"},{"id":103037,"version":"0.1.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-12T16:28:44.000Z","releaseDate":"2026-05-28T07:26:59.000Z","artifactStatus":null}],"findings":[{"id":1067318,"pluginId":"claude-code-bridge","version":"0.1.1","category":"filesystem_access","severity":"info","filePath":"src/lockfile.ts","lineNumber":10,"codeSnippet":"process.env.HOME","explanation":"process.env access reads environment variables","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/radical7vii/obsidian-claude-code-bridge/blob/refs/tags/0.1.1/src/lockfile.ts#L10"},{"id":1067319,"pluginId":"claude-code-bridge","version":"0.1.1","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":18,"codeSnippet":"this.app.vault.adapter","explanation":"Accesses Obsidian API: app.vault","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/radical7vii/obsidian-claude-code-bridge/blob/refs/tags/0.1.1/src/main.ts#L18"},{"id":1067320,"pluginId":"claude-code-bridge","version":"0.1.1","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":28,"codeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/radical7vii/obsidian-claude-code-bridge/blob/refs/tags/0.1.1/src/main.ts#L28"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.1.0","initialDiffTo":"0.1.1","summary":"This plugin can send the text you select in Obsidian to the Claude Code CLI when you use the bridge, so it only needs access to the content you choose rather than the whole vault. The provided metadata shows no use of Obsidian vault APIs and no network activity from the plugin itself. Any network communication would depend on the external Claude Code CLI or its configuration, not on the plugin’s documented behavior.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"esbuild","packageVersion":">=0.27.3 <0.28.1","severity":"low","title":"esbuild allows arbitrary file read when running the development server on Windows","advisoryUrl":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","ghsaId":"GHSA-g7r4-m6w7-qqqr","cveId":null,"vulnerableRange":">=0.27.3 <0.28.1","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=7.0.0 <=7.3.4","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":">=7.0.0 <=7.3.4","fixAvailable":null,"source":"npm-audit","isDi

Claude Code Bridge