Security audit

Awesome Obsidian

Security checks for vulnerabilities and agentic risk

Overview

This Obsidian workflow is not deceptive, but it needs review because its Git sync guidance can automatically upload an entire vault and expose access tokens.

Review this skill before installing. Use it only with a private, intended Obsidian vault; avoid embedding tokens in clone URLs; prefer SSH or a credential manager; add a strict .gitignore; inspect git status and staged diffs before pushing; and do not enable the cron sync unless you are comfortable with unattended uploads of all unignored vault contents.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:151
Finding: Access Token Exposed in Git Clone URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/quick_sync.sh:10
Finding: Unrestricted Staging and Upload of Obsidian Vault Contents
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/toolchain.md:197
Finding: Unattended Recurring Bulk Synchronization of Sensitive Vault Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Placing a Git access token directly in a repository URL exposes the credential in plaintext, where it can be captured in note content, command history, logs, clipboard history, screenshots, plugin configuration, or crash reports. Because this skill centers on Obsidian synchronization across devices, the token may be propagated into synced vaults or mobile environments, substantially increasing the chance of credential compromise and repository takeover.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 该 markdown 文件适用 SQP-1。L003 中的触发词如“Obsidian”“笔记整理”“知识管理”范围较宽，容易与普通对话或大量无关笔记场景重叠；同时未提供排除条件或更具体的触发约束，因此存在误触发风险。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation instructs users to use an access token for repository cloning but does not warn that embedding or handling tokens insecurely can leak credentials through notes, screenshots, plugin settings, shell history, or synced device state. In a note-taking and sync workflow, this context increases exposure because secrets may be replicated across devices and backups.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all headings, labels, and usage instructions in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when they are optional or clearly justified, neither of which is stated here.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes a broad natural-language phrase ("添加到今天的笔记"), which can plausibly appear in ordinary conversation and unintentionally activate the skill. In an agent setting, overbroad triggers can cause unauthorized note modifications or workflow execution without explicit user intent, especially because this skill can later chain into file changes and Git operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document recommends a cron job that performs unattended git pull, git add ., git commit, and git push, but it does not warn that this may automatically stage and upload sensitive, private, or unreviewed notes. In a personal knowledge-management vault, content often includes secrets, diary entries, tokens, or confidential material, so automated syncing materially increases the risk of data exfiltration or irreversible publication.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description is written entirely in Chinese and provides no indication that language choice is optional or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file is natural-language content and falls under the policy check for language or locale constraints. The content consistently uses Chinese throughout, with no indication that users can choose another language or that the document is intentionally limited to a Chinese-speaking audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: SQP-3 适用于所有文件类型。整份技能说明均以中文撰写，并在示例与触发说明中默认使用中文表达，但未说明这是区域性/特定用户群体约束，也未提供语言选择，可能构成未获用户选择的语言/locale 限制。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comment and all user-visible echo messages are written in Chinese, which imposes a specific language on users. Under the policy criteria, locale or language restrictions should be opt-in or clearly justified as region-specific, but this script provides neither.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.