Security audit

Obsidian Viz

Security checks for vulnerabilities and agentic risk

Overview

This Markdown-only skill is a coherent Obsidian diagram generator, with manageable privacy and routing caveats rather than evidence of malicious behavior.

Install only if you want an agent helper that creates local Obsidian-compatible diagram files. Review generated files before adding them to a vault, and avoid sending private chat screenshots, secrets, credentials, or regulated data unless you are comfortable with that content being transcribed into local outputs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 18)May include surrounding context.
md
### ✨ Features - **Two Input Modes** - 📝 Text Description: Create charts from concept/process descriptions - 🖼️ Image Input: Understand IM images (screenshots, diagrams) and redraw as editable formats - **Multiple Output Formats**

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The English trigger list includes very broad terms such as "visualize," "diagram," and "animate," which can match many ordinary user requests unrelated to this specific skill. Overbroad activation increases the chance the skill is invoked unintentionally, causing prompt-routing mistakes, unintended file generation, or exposure of user content to a skill that was not deliberately requested.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Chinese trigger list similarly contains generic phrases like "画图," "可视化," and "生成图表文件," which are broad enough to match common requests outside the intended Obsidian visualization workflow. This can lead to accidental invocation, misrouting of user intent, and unnecessary handling of user-provided text or images by the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file presents the skill example entirely in Chinese and instructs the user at L09-L15 to send Chinese text, without offering a language choice or stating that the skill is intentionally limited to a Chinese-speaking context. This creates a natural-language locale policy concern because it implicitly requires a specific language for use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The section titled '中文内容' defines fixed processing rules for Chinese content and states how all tools should handle Chinese, but the document does not indicate that language behavior is optional or user-selected. This can violate language/locale policy expectations when a skill implicitly assumes or enforces a specific language context without explicit opt-in or clear region-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module explicitly instructs extraction and restructuring of UI and IM/chat screenshot contents, including listing messages chronologically, but provides no safeguards for personal, confidential, or regulated data that may appear in screenshots. In this skill context, that omission increases the chance of unnecessary collection, retention, or propagation of sensitive conversation data into Markdown outputs and downstream tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The interface section directs the module to pass structured diagram data and the original image to another component without any disclosure, minimization, or boundary on what data may be shared. Because images can contain embedded secrets, internal architecture details, or personal data, silent cross-module transfer increases the risk of overexposure and broader unintended access within the agent workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire document is written as prescriptive guidance in Chinese, including headings, field descriptions, examples, and checklists, with no indication that users may choose another language or that the restriction is required for a region-specific purpose. This can violate a language/locale policy when a skill effectively mandates one language without user opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The Obsidian-mode trigger phrases include very broad natural-language terms such as common requests for drawing or flowcharts. In an agent setting, this can cause the skill to activate unintentionally for ordinary user prompts, leading to mode confusion, unexpected file generation, or routing into a formatter the user did not explicitly request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The section labeled “中文文本规则” prescribes Chinese-specific text generation rules, including prohibiting Unicode escaping for Chinese and sizing guidance based on Chinese characters. This imposes a specific language/locale expectation without stating that it is optional, user-selected, or limited to a justified Chinese-only context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The section titled "中文 / CJK 文本规则" states mandatory rules such as "必须用双引号包裹" for labels containing Chinese characters, presenting a language-specific constraint as universal guidance. Because the document does not clarify that these rules apply only when the user is authoring Chinese/CJK Mermaid content, it imposes a locale-specific policy without explicit opt-in or scope limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to always write generated files to a fixed path under ~/.openclaw/workspace/outputs/ without explicitly requiring user awareness or confirmation. While this is not inherently malicious and the directory appears scoped to a workspace, silent file creation can surprise users, overwrite prior outputs, or create unintended persistence on the host filesystem.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown example presents all user-facing instructions and descriptions exclusively in Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language choice or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The entire skill specification is presented in Chinese and all examples and output labels are Chinese, but there is no statement that language is configurable or intentionally restricted to a Chinese-only context. Under the language/locale policy, forcing a single language without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.