obsidian-mcp-macros

The plugin dynamically loads and executes user-provided JavaScript files from the 'mcp-tools' folder using blob URLs and dynamic imports. These dynamically loaded scripts have full access to the Obsidian application (app, vault, workspace) via global window objects, effectively giving arbitrary user-controlled code complete control over the vault and plugin behavior. While a refactoring proposal mentions future sandboxing with `vm2` or `isolated-vm`, the current `main.ts` code does not implement this. This creates a high security risk if untrusted code is placed in the tools folder. Additionally, the planned Python `owui_filesystem_tools.py` with `bash` command execution, if improperly exposed or integrated, represents a severe risk (though it's not directly part of the plugin's `main.ts` dynamic loading). Network exposure is mitigated by default `localhost` binding and planned Tailscale VPN, but misconfiguration could lead to unauthorized access.