Obsidian Notes

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:30 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward Obsidian note helper, but users should be careful with note deletion and the third-party CLI install.

Install only if you are comfortable using the third-party obsidian-cli Homebrew tap, and confirm the active vault before allowing create, move, or delete actions. Treat delete as potentially irreversible and prefer backups, trash/archive workflows, or explicit confirmation for destructive note changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned CLI Installation from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"💎","requires":{"bins":["obsidian-cli"]},"install":[{"id":"brew","kind":"brew","formula":"yakitrak/yakitrak/obsidian-cli","bins":["obsidian-cli"],"label":"Install obsidian-cli (brew)"}]}}

Technical Analysis

The Skill declares obsidian-cli as a required executable and provides an installation instruction that retrieves it from the third-party Homebrew tap yakitrak/yakitrak. The dependency is not constrained to a specific version, formula revision, commit, checksum, or cryptographic signature.

Consequently, the code installed for the same formula identifier can change after this Skill has been reviewed. The listed homepage, https://help.obsidian.md, does not establish that this third-party CLI or Homebrew tap is an official Obsidian distribution. If the tap, its maintainer account, its upstream release process, or a referenced artifact is compromised, attacker-controlled code could be delivered through the dependency installation process.

Attack Path

1. A user or Skill-management framework determines that the required obsidian-cli executable is unavailable.
2. The declared Homebrew installation procedure resolves yakitrak/yakitrak/obsidian-cli.
3. An attacker compromises the third-party tap, a maintainer account, the upstream release source, or an artifact referenced by the formula.
4. Because the dependency is mutable and no version or integrity value is pinned by the Skill, Homebrew retrieves the compromised formula or artifact.
5. Malicious installation logic or a malicious CLI binary executes with the privileges of the user running Homebrew.
6. The compromised CLI can abuse its expected access to Obsidian vaults and local files when subsequently invoked.

Impact Assessment

Successful exp ...[truncated 654 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official, authenticated distribution of the CLI if one is available.
2. If the third-party tap must be retained, pin the dependency to an audited release and immutable formula revision or commit.
3. Verify downloaded artifacts with a trusted cryptographic checksum or signature before installation.
4. Record the expected version and integrity value in the Skill metadata or in a controlled installation script that fails closed on verification errors.
5. Review the Homebrew formula and all transitive download sources before approving updates.
6. Clearly disclose that obsidian-cli is a third-party component and require explicit user confirmation before installing it.
7. Run installation and CLI operations with the minimum necessary user permissions, without administrative elevation, and limit access to the intended vault where feasible.
8. Use automated dependency monitoring so changes to the formula, tap ownership, release artifacts, or checksums trigger a new security review.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly documents a destructive delete command without any warning, confirmation guidance, or safety constraints. In an agent context, this can normalize irreversible note deletion and increase the chance that an LLM or user invokes it on the wrong note or vault, causing data loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.