Aj Obsidian

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:42 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Obsidian note helper, with visible note-management powers and a disclosed third-party CLI dependency.

Before installing, make sure you trust the obsidian-cli Homebrew tap and understand that the skill can help an agent read, create, move, and delete notes in your Obsidian vault. Confirm paths before delete or move operations and rely on backups or version history for important notes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Dependency Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"💎","requires":{"bins":["obsidian-cli"]},"install":[{"id":"brew","kind":"brew","formula":"yakitrak/yakitrak/obsidian-cli","bins":["obsidian-cli"],"label":"Install obsidian-cli (brew)"}]}}

Technical Analysis

The skill declares obsidian-cli as a required executable and directs the installation system to obtain it from the third-party Homebrew tap yakitrak/yakitrak. The dependency declaration does not pin an audited formula revision, package version, source commit, or immutable artifact checksum.

As a result, the software installed when this declaration is processed can differ from the software that existed when the skill was reviewed. Homebrew formulas are executable Ruby definitions and may invoke build or installation logic. A compromise of the tap, its maintainers, the upstream source, or the dependency publication workflow could therefore introduce attacker-controlled code without requiring a modification to this skill package.

The audit found no evidence that the currently referenced dependency is malicious. The vulnerability is the mutable and externally controlled trust relationship created by the unpinned third-party source.

Attack Path

1. An attacker compromises the third-party Homebrew tap, a maintainer account, or an upstream artifact referenced by its formula.
2. The attacker publishes a modified formula or package containing malicious installation or runtime behavior.
3. A user or automated skill installer processes the brew installation declaration in SKILL.md.
4. Homebrew resolves the mutable yakitrak/yakitrak/obsidian-cli formula and downloads the compromised content.
5. Attacker-controlled code runs during installation, build, or subsequent execution of ...[truncated 997 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official, publisher-controlled distribution channel for obsidian-cli where one is available.
2. Pin the dependency to a specifically reviewed release and immutable source revision rather than resolving the latest formula state.
3. Verify downloaded artifacts with a cryptographic checksum or signature controlled by a trusted release process.
4. If the third-party tap must be retained, pin and audit the tap commit and review the complete formula, transitive dependencies, download URLs, and installation hooks.
5. Run installation and CLI operations as an unprivileged user; do not use sudo or grant the executable unnecessary filesystem access.
6. Record the approved version and integrity value in the skill metadata or installation documentation so unexpected dependency changes fail closed.
7. Periodically re-audit the pinned dependency and update it through a controlled review process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file instructs users to delete notes with obsidian-cli delete "path/note" but does not warn that the operation may remove user content irreversibly or move it out of the vault. For markdown files, destructive behaviors affecting user data should be accompanied by a clear warning about impact and recovery considerations.

Content

No source excerpt is available for this finding.