ClawHub
Back to skill

Security audit

Obsidian Helper

Security checks for vulnerabilities and agentic risk

Overview

This Obsidian helper is a disclosed local note-management skill, but its installer is incomplete and it should be used carefully around edits, deletes, and shell profile changes.

Install only if you are comfortable with a skill modifying your shell profile and operating on your Obsidian vault. Confirm the missing obsidian command script before relying on it, set OBSIDIAN_VAULT explicitly, and treat delete or edit operations as potentially irreversible unless you have backups or version control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
riable** (highest priority):
   ```bash
   export OBSIDIAN_VAULT=/path/to/your/vault
   ```

2. **WSL environment**: Auto-detects Windows user directory
   ```
   /mnt/c/Users/<WindowsUser>/Documents/Obsidian
   ```

3. **Linux environment**: Uses default path
   ```
   ~/obsidian
   ```

4. **Set your Obsidian vault path** (optional - auto-detects if not set):
   ```bash
   # Add to ~/.bashrc
   echo 'export OBSIDIAN_VAULT=/mnt/c/Users/YourName/Documents/Obsidian/Vault' >> ~/.bashrc
   source ~/.bashrc
   ```
   
## Commands Reference

| Command | Aliases | Description |
|---------|---------|-------------|
| `list` | `ls`, `l` | List all markdown notes in vault |
| `search <term>` | `s`, `find` | Search content in notes |
| `create <name> [content]` | `c`, `new` | Create new note |
| `read <name>` | `r`, `cat`, `show` | Read note content |
| `edit <name>` | `e`, `vim` | Edit note in vim |
| `daily [date]` | `d`, `today` | Create/view daily note |
| `delete <name>` | `del`, `rm` | Dele
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
#!/bin/bash
# install.sh - 安装 obsidian helper

set -e

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

echo "=== Obsidian Helper 安装 ==="

# 创建 bin 目录
mkdir -p ~/bin

# 复制脚本
cp "$SCRIPT_DIR/scripts/obsidian" ~/bin/obsidian
chmod +x ~/bin/obsidian

# 添加到 PATH
if ! grep -q 'export PATH="$HOME/bin:$PATH"' ~/.bashrc 2>/dev/null; then
    echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc
    echo "已添加 ~/bin 到 PATH"
fi

echo ""
echo "✅ 安装完成！"
echo ""
echo "使用方法:"
echo "  obsidian list        # 列出笔记"
echo "  obsidian search 关键词 # 搜索"
echo "  obsidian create 文件名 # 创建笔记"
echo "  obsidian help        # 查看帮助"
echo ""
echo "配置 vault 路径:"
echo "  export OBSIDIAN_VAULT=/path/to/your/vault"
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation clearly instructs use of shell commands and installation steps, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and review gap: the agent could invoke shell-backed capabilities without explicit restriction, making the skill harder to safely govern.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger condition includes broad language like 'any Obsidian vault operations,' which can cause the skill to activate in many contexts beyond clear user intent. Over-broad activation is dangerous because it increases the chance that a file-manipulating skill runs when the user only mentioned Obsidian conceptually or ambiguously.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises edit and delete capabilities without any warning that these operations modify or permanently remove vault content. In a note-management context, this omission increases the likelihood of accidental destructive actions against user data, especially when paired with shell execution and broad activation.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
obsidian list              # 列出所有笔记
obsidian search 关键词      # 搜索笔记内容
obsidian create 文件名      # 创建新笔记
obsidian read 文件名        # 读取笔记
obsidian edit 文件名        # 编辑笔记 (vim)
obsidian daily             # 创建/查看日报
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
4. **Set your Obsidian vault path** (optional - auto-detects if not set):
   ```bash
   # Add to ~/.bashrc
   echo 'export OBSIDIAN_VAULT=/mnt/c/Users/YourName/Documents/Obsidian/Vault' >> ~/.bashrc
   source ~/.bashrc
   ```
Confidence
90% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The script's human-facing comments and output strings are in Chinese throughout, including installation status and usage instructions. This imposes a specific language on users without opt-in or explanation, which matches the language/locale policy violation category.

Session Persistence

Medium
Category
Rogue Agent
Content
echo "=== Obsidian Helper 安装 ==="

# 创建 bin 目录
mkdir -p ~/bin

# 复制脚本
cp "$SCRIPT_DIR/scripts/obsidian" ~/bin/obsidian
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.