ClawHub
Back to skill

Security audit

Obsidian Helper

Security checks for vulnerabilities and agentic risk

Overview

This Obsidian helper is a disclosed local note-management skill, but its installer is incomplete and it should be used carefully around edits, deletes, and shell profile changes.

Install only if you are comfortable with a skill modifying your shell profile and operating on your Obsidian vault. Confirm the missing obsidian command script before relying on it, set OBSIDIAN_VAULT explicitly, and treat delete or edit operations as potentially irreversible unless you have backups or version control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

riable** (highest priority):

bash
export OBSIDIAN_VAULT=/path/to/your/vault

  1. WSL environment: Auto-detects Windows user directory

    text
    /mnt/c/Users/<WindowsUser>/Documents/Obsidian

  2. Linux environment: Uses default path

    text
    ~/obsidian

  3. Set your Obsidian vault path (optional - auto-detects if not set):

    bash
    # Add to ~/.bashrc
echo 'export OBSIDIAN_VAULT=/mnt/c/Users/YourName/Documents/Obsidian/Vault' >> ~/.bashrc
source ~/.bashrc

Commands Reference

CommandAliasesDescription
listls, lList all markdown notes in vault
search <term>s, findSearch content in notes
create <name> [content]c, newCreate new note
read <name>r, cat, showRead note content
edit <name>e, vimEdit note in vim
daily [date]d, todayCreate/view daily note
delete <name>del, rmDele

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/install.sh (reported line 19)May include surrounding context.

sh
#!/bin/bash
# install.sh - 安装 obsidian helper

set -e

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

echo "=== Obsidian Helper 安装 ==="

# 创建 bin 目录
mkdir -p ~/bin

# 复制脚本
cp "$SCRIPT_DIR/scripts/obsidian" ~/bin/obsidian
chmod +x ~/bin/obsidian

# 添加到 PATH
if ! grep -q 'export PATH="$HOME/bin:$PATH"' ~/.bashrc 2>/dev/null; then
    echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc
    echo "已添加 ~/bin 到 PATH"
fi

echo ""
echo "✅ 安装完成！"
echo ""
echo "使用方法:"
echo "  obsidian list        # 列出笔记"
echo "  obsidian search 关键词 # 搜索"
echo "  obsidian create 文件名 # 创建笔记"
echo "  obsidian help        # 查看帮助"
echo ""
echo "配置 vault 路径:"
echo "  export OBSIDIAN_VAULT=/path/to/your/vault"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documentation clearly instructs use of shell commands and installation steps, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and review gap: the agent could invoke shell-backed capabilities without explicit restriction, making the skill harder to safely govern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition includes broad language like 'any Obsidian vault operations,' which can cause the skill to activate in many contexts beyond clear user intent. Over-broad activation is dangerous because it increases the chance that a file-manipulating skill runs when the user only mentioned Obsidian conceptually or ambiguously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises edit and delete capabilities without any warning that these operations modify or permanently remove vault content. In a note-management context, this omission increases the likelihood of accidental destructive actions against user data, especially when paired with shell execution and broad activation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash
obsidian list              # 列出所有笔记
obsidian search 关键词      # 搜索笔记内容
obsidian create 文件名      # 创建新笔记
obsidian read 文件名        # 读取笔记
obsidian edit 文件名        # 编辑笔记 (vim)
obsidian daily             # 创建/查看日报

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

  1. Set your Obsidian vault path (optional - auto-detects if not set):
    bash
    # Add to ~/.bashrc
echo 'export OBSIDIAN_VAULT=/mnt/c/Users/YourName/Documents/Obsidian/Vault' >> ~/.bashrc
source ~/.bashrc

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's human-facing comments and output strings are in Chinese throughout, including installation status and usage instructions. This imposes a specific language on users without opt-in or explanation, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 11)May include surrounding context.

sh
echo "=== Obsidian Helper 安装 ==="

# 创建 bin 目录
mkdir -p ~/bin

# 复制脚本
cp "$SCRIPT_DIR/scripts/obsidian" ~/bin/obsidian