ClawHub
Back to skill

Security audit

Obsidian Official CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Obsidian CLI reference, but it gives agents broad power over a user's vault and Obsidian configuration without enough safety guidance.

Install only if you are comfortable letting an agent operate on your Obsidian vault. Use it with explicit vault and file/path limits, require confirmation before writes, deletes, restores, publishing, plugin/theme changes, eval, or DevTools commands, and prefer trusted/pinned installation sources for any CLI wrapper or Homebrew tap.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:37
Finding

Unverified Third-Party Homebrew Distribution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 122)May include surrounding context.

wershell

Edit profile

notepad $PROFILE

Add this line

$env:PATH += ";$env:LOCALAPPDATA\Obsidian"

Reload

. $PROFILE

text

**3. Test**

```powershell
obsidian version
obsidian vault

Linux

1. Enable CLI in Obsidian

Settings → General → Enable CLI

2. Add to PATH

Snap:

bash
# Already in PATH
obsidian version

Flatpak:

bash
# Add alias to ~/.bashrc
echo 'alias obsidian="flatpak run md.obsidian.Obsidian"' >> ~/.bashrc
source ~/.bashrc

AppImage:

bash
# Move to ~/.local/bin
mv Obsidian-*.AppImage ~/.local/bin/obsidian
chmod +x ~/.local/bin/obsidian

# Add to PATH
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

3. Test

bash
obsidian version
obsidian vault

OpenClaw Use Cases

📅 Daily Journal Automation

Your AI assistant can maintain your daily journal automatically:

bash
# Create today's daily note
obsidian daily

# Add morning tasks
obsidian daily:append content="## Morni

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill is designed around ongoing management of journals, notes, tasks, databases, and workspace state inside a persistent Obsidian vault, which creates durable side effects across sessions. While this persistence is core functionality rather than overtly malicious behavior, it is security-relevant because an agent can accumulate changes, expose sensitive notes, or silently reshape user data over time.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md
This OpenClaw skill provides **complete access to Obsidian's official CLI** (v1.12+), enabling AI agents to:

- 📝 **Automate note-taking**: Create daily journals, meeting notes, project logs
- ✅ **Manage tasks**: Toggle task status, filter by completion, track progress
- 🔍 **Search and organize**: Find notes, create links, manage tags
- 🗄️ **Work with databases**: Query bases, create items, manage views

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly promotes automatic read, write, and organization of a user's Obsidian vault by an AI assistant, but it does not warn that these commands can modify or overwrite personal notes and metadata. In an agent-executed context, this increases the risk of unintended data tampering, destructive edits, or privacy-impacting reorganization of a persistent knowledge base.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented plugin installation, theme changes, and workspace operations alter application configuration and can introduce third-party code or persistent environment changes, yet the README presents them as routine automation without warning. In an AI agent setting, this makes it easier for an agent to change user configuration or install extensions without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prominently documents powerful commands including file deletion, history restore, plugin installation, JavaScript execution, and Chrome DevTools access, but provides no warning, gating, or usage guidance for risky operations. In an agent setting, this increases the chance that an automated system or user invokes destructive or code-execution functionality without understanding that these commands can alter vault contents, install untrusted extensions, or execute arbitrary code inside Obsidian.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The quick reference documents a destructive obsidian delete file="Old Note" command without any adjacent warning, confirmation guidance, or safer alternative. In an AI-agent-oriented skill, terse examples are likely to be copied or auto-selected by agents, which increases the chance of unintended data loss if the wrong note name is supplied or the command is used in the wrong context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The release notes explicitly advertise 'Chinese: 中文说明', which indicates the skill content may constrain outputs or guidance to Chinese without presenting language choice. While not a classic security flaw, this can degrade user control and cause agents to ignore user language preferences, which is a real policy/quality issue in an agent skill. In this context, the surrounding document also contains authoritative approval language and release instructions, so embedded language constraints are slightly more concerning because they may be propagated into the published skill as normative behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The entire report is written in Chinese and includes no indication that language selection is optional or user-driven. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless the regional constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.