Obsidian 1 0 0.Local.Backup

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Obsidian helper that can read, create, move, and delete notes through obsidian-cli, with no hidden execution or unrelated behavior found.

Install only if you are comfortable granting obsidian-cli access to your Obsidian vaults. Confirm the active vault and exact note path before create, move, or delete operations, and consider backing up important vaults before using delete or bulk edits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Executable Dependency from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"💎","requires":{"bins":["obsidian-cli"]},"install":[{"id":"brew","kind":"brew","formula":"yakitrak/yakitrak/obsidian-cli","bins":["obsidian-cli"],"label":"Install obsidian-cli (brew)"}]}}

Technical Analysis

The skill directs the environment to install the obsidian-cli executable from the third-party Homebrew tap yakitrak/yakitrak. The dependency is not pinned to an immutable version or commit, and no integrity checksum or signature is specified.

Consequently, the code installed during a future setup may differ from the dependency implicitly reviewed when this skill was published. If the tap, its maintainer account, its source repository, or its release infrastructure is compromised, its formula could be modified to install or execute attacker-controlled code. This is a supply-chain trust risk; the audit did not establish that the current package is malicious.

Attack Path

1. An attacker compromises the third-party Homebrew tap, a maintainer account, or an upstream artifact referenced by its formula.
2. The attacker modifies the mutable formula or package artifact to include malicious installation or runtime behavior.
3. A user installs the skill dependency through the declared brew installation entry.
4. Homebrew retrieves and processes the compromised formula or artifact.
5. The malicious dependency executes during installation or when the agent invokes obsidian-cli.
6. The code operates with the permissions of the user running Homebrew or the agent and can target resources accessible to that account.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. The compromised CLI could read, alter, or delete accessible Obsidian notes and configuratio ...[truncated 368 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official, publisher-verified distribution channel for obsidian-cli.
2. Pin the dependency to an immutable, reviewed release version or source commit rather than a mutable formula reference.
3. Verify downloaded artifacts with a cryptographic checksum or signature anchored to a trusted publisher key.
4. Audit and lock the Homebrew formula and all upstream download URLs before deployment.
5. Document that yakitrak/yakitrak is a third-party trust boundary and provide its verified source repository and maintainer information.
6. Run the CLI with least privilege and restrict its filesystem access to explicitly selected Obsidian vaults where practical.
7. Monitor dependency updates and require security review before changing the pinned version or integrity metadata.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file explicitly instructs use of obsidian-cli delete "path/note" but provides no warning that the action removes user data and may be irreversible. Under the markdown-specific missing-warning rule, destructive behavior affecting user data should be accompanied by a clear caution or confirmation expectation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.