anation":"Reads all markdown files in your vault","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/jdenoy/obsidian-smart-tagger/blob/refs/tags/1.2.2/main.ts#L287"}],"factors":null,"networkEndpoints":[{"host":"api.anthropic.com","url":"https://api.anthropic.com/v1/messages","filePath":"ai-service.ts","lineNumber":133,"codeSnippet":" 130 | \t\t}\n 131 | \n 132 | \t\ttry {\n> 133 | \t\t\tconst response = await requestUrl({\n 134 | \t\t\t\turl: 'https://api.anthropic.com/v1/messages',\n 135 | \t\t\t\tmethod: 'POST',\n 136 | \t\t\t\theaders: {","networkType":"active-outbound","sendsData":true,"dataDescription":"requestUrl() makes a network request to api.anthropic.com (https://api.anthropic.com/v1/messages)","endpointSource":"hardcoded-url"},{"host":"api.openai.com","url":"https://api.openai.com/v1/chat/completions","filePath":"ai-service.ts","lineNumber":92,"codeSnippet":" 89 | \t\t}\n 90 | \n 91 | \t\ttry {\n> 92 | \t\t\tconst response = await requestUrl({\n 93 | \t\t\t\turl: 'https://api.openai.com/v1/chat/completions',\n 94 | \t\t\t\tmethod: 'POST',\n 95 | \t\t\t\theaders: {","networkType":"active-outbound","sendsData":true,"dataDescription":"requestUrl() makes a network request to api.openai.com (https://api.openai.com/v1/chat/completions)","endpointSource":"hardcoded-url"}],"initialDiff":null,"initialDiffFrom":"1.2.1","initialDiffTo":"1.2.2","summary":"The plugin reads one selected vault file and can also read all markdown files in your vault to collect note content for tag generation. When you use it, it sends that content to OpenAI’s Chat Completions API or Anthropic’s Messages API to generate 2–5 tags. In practice, it sends data to `api.openai.com` and `api.anthropic.com`, so it can transmit vault content to those services during operation.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"form-data","packageVersion":">=4.0.0 <4.0.6","severity":"high","title":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","advisoryUrl":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","ghsaId":"GHSA-hmw2-7cc7-3qxx","cveId":null,"vulnerableRange":">=4.0.0 <4.0.6","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.3.0","severity":"high","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","advisoryUrl":"https://github.com/advisories/GHSA-52cp-r559-cp3m","ghsaId":"GHSA-52cp-r559-cp3m","cveId":null,"vulnerableRange":">=4.0.0 <4.3.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":8,"directDeps":1,"transitiveDeps":0}}]]}]

Smart Tagger