Sync Obsidian to Lexiang

• Outcome: Review
• Latest audit: Jul 15, 2026 · 1:44 PM UTC
• Version: 2.1.1

Overview

The skill mostly matches its note-sync purpose, but it also tries to recover local agent session headers from running processes, which needs user review before installation.

Install only if you are comfortable with a sync tool reading your selected Obsidian vault, uploading its Markdown and attachments to Tencent Lexiang, writing sync state inside the vault, and using local Lexiang credentials. Review or disable the MCP proxy fallback that scans running agent processes for Authorization/session headers; prefer explicit personal credentials via --lexiang-profile or --lexiang-credential-file and run --dry-run first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 从进程列表解析（macOS / Linux 通用）
    try:
        out = subprocess.check_output(["ps", "aux"], text=True, stderr=subprocess.DEVNULL)
        for line in out.splitlines():
            # 匹配 WorkBuddy / QClaw / CodeBuddy 进程，且包含 mcp-config
            lower = line.lower()

• Confidence: 93% confidence
• Finding: The subprocess call itself is not the core issue, but here it is used to enumerate local processes and parse command-line data for MCP proxy URL and authentication headers. In this skill’s sync context, scanning process listings to recover bearer credentials from other agent processes creates an unauthorized credential-access path and expands the trust boundary beyond the declared token sources.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares substantial capabilities in practice—environment access, file read/write, shell execution, and network use—yet does not explicitly declare permissions. This creates a transparency and policy-enforcement gap: users or the platform may authorize the skill without understanding that it can access local vault contents, invoke external commands, and transmit data to Tencent Lexiang or related tooling.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code deliberately inspects local agent process listings to extract Authorization and session headers, then reuses them to access an MCP proxy. That is credential harvesting from unrelated local processes and can enable unauthorized use of another tool’s authenticated session, which is far more dangerous than normal sync functionality requires.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The test suite hard-codes a real local Obsidian vault path and real Lexiang target identifiers, creating a path for accidental interaction with live user data during test execution. In a sync tool, this is especially risky because tests may scan sensitive notes or prepare operations against a real knowledge-base destination, violating least surprise and increasing the chance of data exposure or unintended modification.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger description is broad enough that ordinary requests about note syncing or knowledge-base synchronization could activate the skill unintentionally. Because this skill performs filesystem scanning, stateful sync operations, credential selection, and networked uploads, accidental invocation could expose private notes or start unintended synchronization to a remote knowledge base.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code accesses sensitive authentication headers from local process listings without any user-facing disclosure or consent. In a tool that synchronizes notes, silently harvesting active session credentials is unexpected behavior and increases the chance of unauthorized access and covert misuse of existing authenticated sessions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: These real-vault tests target a specific user's vault and real destination IDs without an in-file warning or strong execution guard, so a normal test run could touch production-like content. Given the skill's purpose is syncing personal notes to a remote knowledge base, this context makes accidental privacy leakage and unintended remote operations materially more dangerous than in generic test code.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.