---
title: Vault Operator v2.6
---

# Vault Operator v2.6: Skill Packages, Universal Import, Vault Health at a Glance

Released 2026-04-19. First minor bump since v2.5: brings the Anthropic-compatible skill-package format into Vault Operator, replaces the single-file skill import with a universal picker, sharpens the sidebar with a stethoscope-style vault-health indicator, and closes a dozen bugs that community testers surfaced between v2.5.3 and v2.6.0.

## Highlights

### Anthropic-compatible skill packages (EPIC-022)

Vault Operator now understands the full Anthropic skill folder format: a skill is a folder with `SKILL.md` and optional `scripts/`, `references/`, `assets/` subfolders. Nested paths inside those sidecars (e.g. `assets/templates/master.potx`, `assets/icons/pack/icon.svg`) are supported end to end. Existing single-file skills keep working unchanged.

The loader exposes every sidecar file in the system prompt as a "next step" hint (scripts marked sandbox-executable, references marked "read on demand", assets marked static), so the agent knows what to reach for without inlining file contents into the prompt.

### Universal skill import

One Import button in Settings -> Skills handles every shape a skill can arrive in:

- Single `.md` file (existing flow).
- Folder picked via the native Electron dialog, scanned for `SKILL.md` and whitelisted sidecars.
- `.skill` or `.zip` archive extracted through JSZip with path-traversal rejection, whitelist filter, and a 100 MB zip-bomb guard.

When a skill already exists, a Replace / Cancel modal prompts before overwrite.

### Prefix split: `/` `#` `§`

The chat input now uses one prefix per category:

- `/<slug>` runs a skill (Claude-Code muscle memory).
- `#<slug>` inserts a custom prompt template.
- `§<slug>` runs a workflow.

The autocomplete dropdown filters strictly by prefix. The `+` button below the chat opens a searchable command picker, anchored like the `@`-file picker, so the whole skill/prompt/workflow library stays discoverable without typing anything.

### Inline `@`-references

Picking a note from the `@` autocomplete now keeps the `@<basename>` token inline in the textarea. Writing `Read @Meeting-Notes and summarise the decisions` now reads naturally, and the attachment chip above the input still populates.

### Vault-health indicator

A stethoscope icon replaces the severity dot next to the sidebar title. Red for high-severity findings, orange for medium, hidden when the vault has no findings. Placement moved to the header-right group, next to the settings gear. The sidebar title shortens to just "Vault Operator".

## Sandbox + Tool-Execution hardening

- SandboxBridge now normalises vault paths (strips trailing slashes, maps `/` / `.` / `./` to the root) before validation, so natural agent phrasing like `ctx.vault.list('Notes/')` no longer fails with "Not a folder" and no longer drives the circuit breaker to trip.
- The circuit breaker auto-resets after a 30 s cooldown. Once-tripped sandboxes no longer stay wedged for the rest of the session.
- `read_file` retries stripped `tmp/task-*` paths against the agent-folder prefix. If the LLM forgets the `.obsidian-agent/` prefix when reading back an externalised tool result, the retry recovers transparently.
- Externalizer cleanup now retries EPERM three times with backoff before logging a warning and leaving the directory for the next plugin start to sweep. Handles the macOS iCloud transient-lock case.
- FastPath planner is tolerant of JSON wrapped in prose or markdown fences; recipes no longer drop to the normal loop because a model added a preamble.

## Community-feedback wave 4

Four fixes triggered by issue #31 from @nicholas-leonard:

- **Drag & drop from Obsidian's file explorer** attaches the file instead of opening it in a new tab. The drop handler now reads `app.dragManager.draggable` and blocks propagation so the workspace does not steal the event.
- **`vault_health_check` and `ingest_document`** are in the default tool groups. A coverage test guards against future drift.
- **Sandbox integrity hashes** for `esbuild-wasm@0.24.2` refreshed against the live jsdelivr CDN. Initial sandbox load no longer fails verification.
- **`SandboxBridge.vaultList('/')`** returns the vault root via `vault.getRoot()` instead of throwing.

## Breaking changes

None at the user level. The `/<slug>` prefix now routes strictly to skills. Workflows move to `§<slug>`, custom prompts move to `#<slug>`. The `+` button shows every registered item, so no command is gated behind knowing the right prefix.

For anyone hot-reloading Vault Operator via BRAT: the BRAT-update race that blanked out the sidebar input is fixed. Settings, the mode service, and the vault-health indicator now all wait on a plugin-readiness promise before the view renders.

## Verification

- 446 / 446 unit tests pass (80+ added during the Wave-4 cycle).
- AUDIT-012 security audit: 0 Critical / 0 High. Release verdict GREEN.
- `obsidianmd/*` review-bot check: 0 findings.
- npm audit: 0 vulnerabilities across 1055 dependencies.
- Build clean.

## Install

Via BRAT:

1. BRAT -> Add Beta Plugin -> `https://github.com/pssah4/vault-operator`

Manually:

1. Download `main.js`, `manifest.json`, `styles.css` into `.obsidian/plugins/vault-operator/`.
2. Download and extract `obsilo-assets.tar.gz` into the same folder.

## What is next

The v2.7 cycle will pick up:

- SEC-M-1: cap HTML-comment metadata length + parseFrontmatter line count (deferred from AUDIT-012).
- SEC-L-1: regression test for the JSZip `_data.uncompressedSize` private field.
- FEATURE-2203 (skill scripts execution via sandbox) and FEATURE-2204 (coordinator sub-roles): the two EPIC-022 features that were kept out of v2.6 to stabilise the folder-format core first.

Deep thanks to @nicholas-leonard for the detailed bug reports that drove Wave 4.
