ClawHub

AI研究保存到Obsidian

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed instruction-only workflow for sending a user’s research question to AI websites and saving the result as an Obsidian note.

Install only if you are comfortable with research prompts being submitted to the listed AI providers and with generated Markdown being saved into your Obsidian vault. Confirm the provider, vault path, and filename before saving, especially for sensitive or proprietary questions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger condition includes broad natural-language phrases like '帮我查一下' combined with saving to notes/Obsidian, which can overlap with ordinary conversation and cause unintended activation. This increases the chance the agent performs browser research and note-writing actions when the user did not clearly intend to invoke this skill.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to locate local Obsidian vault paths and move files into them, which is a filesystem-modifying action, but it does not require explicit user approval before discovery of local paths or file movement. This can lead to unintended writes into user storage, misplacement of files, or privacy issues from interacting with local note repositories.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal