nubaby-obsidian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:38 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches Obsidian note-governance work, but it ships live-looking authentication secrets and unsafe gateway details that should be reviewed before installation.

Do not install or publish this version as-is. Rotate the exposed credentials, remove real tokens from the skill, replace them with placeholders or secret-store instructions, secure non-loopback gateway access, and patch the helper script to pass ripgrep options before `--`. Treat any install as access to private Obsidian vault content and require explicit user direction before search, edit, move, or delete operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/READONLY_GATEWAY_BOUNDARIES.md:44

Finding

Hard-Coded Gateway and Upstream API Credentials

Content

View full analysis

Vulnerability Details

File Location: references/READONLY_GATEWAY_BOUNDARIES.md, lines 44–48
Vulnerability Type: Hard-coded authentication secrets
Risk Level: Critical

Vulnerable Code

md

## Token boundary
- `27133` gateway bearer: `arthur-obsidian-readonly-20260312`
- `27124` plugin bearer / apiKey: `b9cf98bc7b7e074996691b54243a3154ca7b59e136c780388add760c25c5eeff`
- Do not use the gateway token against `27124`
- Do not use the `27124` plugin token against `27133`

Technical Analysis

Two live-looking authentication credentials are stored directly in distributable Skill documentation. Any person, agent, backup service, package registry, or source-control user with access to the project can recover and attempt to reuse them.

The gateway credential appears to authorize read-only access to the Arthur-OS vault. The upstream credential protects an Obsidian Local REST API service. According to references/NETWORK_SEARCH_DESIGN_HISTORY.md, that API can expose note creation, update, deletion, and command execution capabilities. Although the effective permissions depend on the deployed plugin configuration, disclosure of this upstream credential may therefore compromise more than read-only search.

Separating the credentials by port does not mitigate disclosure because both credentials and their intended endpoints are documented together.

Attack Path

1. An attacker obtains the Skill package, a repository checkout, an archive, or a logged copy of this documentation.
2. The attacker extracts the bearer token and API key from lines 45–46.
3. The attacker gains network access to the documented LAN gateway or upstream plugin endpoint.
4. The attacker submits the corresponding credential to port 27133 or 27124.
5. If the credentials remain valid, the attacker accesses the capabilities exposed by the relevant service.

Impact Assessment

The gateway credential can expose note names, n ...[truncated 447 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate both disclosed credentials immediately.
2. Remove the credentials from the current repository and all retained history, releases, archives, logs, and mirrored Skill copies.
3. Replace real values in documentation with unambiguous placeholders, such as GATEWAY_BEARER_TOKEN and OBSIDIAN_API_KEY.
4. Load credentials at runtime from a protected secret manager, operating-system keychain, or environment file excluded from source control.
5. Use distinct, randomly generated, least-privilege credentials for the gateway and upstream service.
6. Ensure the gateway credential grants read-only access and cannot be reused against the upstream plugin.
7. Disable command execution and write operations on the upstream API unless explicitly required.
8. Implement expiration, routine rotation, access logging, rate limiting, and credential-reuse detection.
9. Add automated secret scanning to pre-commit and CI workflows.

T09 · Insecure Skill Coding Practices

Error

• Location: references/READONLY_GATEWAY_BOUNDARIES.md:8

Finding

Bearer Authentication Documented over Plaintext LAN HTTP

Content

View full analysis

Vulnerability Details

File Location: references/READONLY_GATEWAY_BOUNDARIES.md, lines 8–13 and 23–24
Vulnerability Type: Plaintext transmission of authentication credentials
Risk Level: High

Vulnerable Code

md

1. Mac Studio local endpoint: `http://127.0.0.1:27133`
2. Other nodes (5090 / 5092 / 5094 / Mac mini): `http://10.0.1.10:27133`
3. Do not use a node's own `127.0.0.1:27133`
4. Gateway health must use `/health`
5. A `not_found` response from `/` is normal
6. `27133` and `27124` use different authentication layers

### Other nodes
- gateway: `http://10.0.1.10:27133`
- health: `http://10.0.1.10:27133/health`

The bearer credential used by this endpoint is defined at line 45:

md

- `27133` gateway bearer: `arthur-obsidian-readonly-20260312`

Technical Analysis

The remote LAN endpoint is explicitly documented with the unencrypted http:// scheme while authentication relies on a bearer token. HTTP does not protect request headers or response bodies in transit.

A bearer token grants access based solely on possession. A party capable of observing or redirecting LAN traffic may capture the authorization header and replay it. The same party may also inspect returned note content or modify unauthenticated transport traffic. A trusted LAN alone is not an adequate confidentiality or integrity boundary.

The localhost endpoint has a smaller interception surface, but the documented 10.0.1.10 route crosses the network and is directly affected.

Attack Path

1. A legitimate node sends an authenticated request to http://10.0.1.10:27133.
2. An attacker obtains a network observation position, such as a compromised LAN host, wireless access point, router, switch mirror, or successful address-resolution spoofing position.
3. The attacker captures the plaintext authorization header or redirects the connection.
4. The attacker replays the bearer token against the gateway.

...[truncated 612 chars]

Remediation

View remediation

Remediation Suggestions

1. Require HTTPS for every non-loopback gateway connection.
2. Use a certificate issued by a trusted internal certificate authority and enforce certificate validation on clients.
3. Prefer mutual TLS or a securely configured private overlay network when access is limited to managed nodes.
4. Reject plaintext authenticated requests rather than redirecting them, because the credential may already have been exposed before a redirect is processed.
5. Rotate the currently documented bearer token after encrypted transport is deployed.
6. Use short-lived, scoped credentials instead of a permanent shared bearer token.
7. Restrict the gateway with host firewall rules and permit only explicitly authorized source nodes.
8. Add replay resistance, access logging, rate limits, and alerts for unusual source addresses or query volumes.
9. Avoid returning credentials or sensitive authentication details from health and diagnostic endpoints.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ob_search.sh:29

Finding

Ripgrep Option Injection through an Untrusted Search Query

Content

View full analysis

Vulnerability Details

File Location: scripts/ob_search.sh, lines 29–36
Vulnerability Type: Command option injection with potential command execution
Risk Level: High

Vulnerable Code

bash

skill)
  if [[ -z "$QUERY" ]]; then
    echo "usage: ob_search.sh skill <query>" >&2
    exit 1
  fi
  VAULT="$(obsidian-cli print-default --path-only)"
  rg -n -S "$QUERY" "$VAULT/Skills" --glob '*.md'
  ;;

Technical Analysis

Shell quoting protects $QUERY from word splitting and shell metacharacter expansion, but it does not prevent the receiving program from treating the argument as an option. Because no -- option terminator appears before the user-controlled query, a value beginning with - can be parsed by rg as a command-line option rather than as the intended pattern.

This permits alteration of ripgrep behavior. In versions of ripgrep that support preprocessing, options such as --pre can specify an external preprocessing command. A crafted single argument using the --option=value form may therefore cause ripgrep to invoke an attacker-selected local command when the remaining execution conditions cause files to be processed.

Even when command-executing options are unavailable or environmental conditions prevent preprocessing, option injection can still change file traversal, output behavior, resource consumption, or search semantics. The vulnerability is therefore present independently of whether a particular command-execution attempt succeeds.

Attack Path

1. An attacker controls or influences the query supplied to ob_search.sh skill.
2. The attacker supplies a query beginning with a ripgrep option, potentially using an --option=value form.
3. The shell passes that value as one quoted argument, but ripgrep interprets it as an option because no -- terminator was used.
4. Ripgrep applies the attacker-selected behavior instead of treating the value exclusivel ...[truncated 805 chars]

Remediation

View remediation

Remediation Suggestions

Place all intended ripgrep options before an explicit option terminator:

bash

rg -n -S --glob '*.md' -- "$QUERY" "$VAULT/Skills"

Additional hardening should include:

1. Use fixed-string search with -F if regular expressions are not required:

   bash

   rg -n -S -F --glob '*.md' -- "$QUERY" "$VAULT/Skills"
   

2. Validate query length and reject control characters to limit resource-exhaustion and output-manipulation risks.
3. If regular expressions are required, impose a reasonable query-length limit and execution timeout.
4. Apply explicit option boundaries to other command invocations receiving user-controlled arguments wherever the invoked CLI supports them.
5. Add regression tests using inputs such as --help, --version, and --pre=value to verify that they are treated only as search patterns.
6. Run the helper with the minimum filesystem permissions necessary to read the intended vault subtree.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a decision/governance skill for classifying where notes and documents belong in the Obsidian vault. The supplied code does not implement placement logic, categorization rules, or note-location decisions. Instead, it provides operational search utilities via obsidian-cli and ripgrep, including printing the default vault path and searching note names, content, or markdown files under Skills. While the description briefly mentions searching the vault with obsidian-cli, the primary declared purpose is governance of note placement, whereas the code is purely a search helper. That is a materially different primary behavior, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This documentation embeds live internal network endpoints and bearer tokens inside a governance skill whose stated purpose is note-placement, not secret distribution or operational access. Even if the gateway is intended to be read-only, disclosure of valid credentials and service topology materially lowers the barrier to unauthorized access, reconnaissance, and pivoting to adjacent services.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document discloses bearer tokens in cleartext and explains which token maps to which service, which is direct credential exposure. In the context of a skill package that may be widely read, indexed, or reused by agents, this is especially dangerous because it enables immediate authenticated access attempts against internal services without further compromise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description contains very broad activation triggers such as using the skill whenever working with Arthur-OS, Obsidian, creating or editing notes, or deciding where content belongs. In an agentic system, that can cause the skill to activate in ordinary conversations and grant access to search/path-discovery behaviors more often than necessary, increasing unintended data exposure from the vault.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The core instructional content is written in Traditional Chinese and presents the skill behavior in that language without indicating that language selection is optional. Under the policy, forcing a language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file's instructions are written entirely in Traditional Chinese and present the purpose and guidance in that language without offering any alternative language or user choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document is written entirely in Traditional Chinese and presents operational rules as mandatory guidance without any indication that users may choose another language or locale. This can violate a language/locale policy when the skill is expected to be generally usable unless a locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The heading "10 秒路由" and the rest of the document are written entirely in Traditional Chinese, which effectively forces one language for skill guidance. The file does not indicate that language selection is optional or that the locale restriction is intentional for a region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file is written entirely in Traditional Chinese and does not provide an opt-in, alternative language, or justification that this skill is region- or locale-specific. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file explicitly states the gateway is not for remote control, but later reveals the upstream Obsidian plugin API token for a separate service on port 27124. That contradiction is dangerous because it normalizes trust in a read-only boundary while simultaneously exposing credentials for a more sensitive non-gateway interface, enabling misuse if that upstream service is reachable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document is written entirely in Traditional Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language violations, a skill that effectively requires one language without opt-in should be flagged unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses only Chinese for its policy/instruction content, which can amount to a language policy constraint for users or maintainers who do not read that language. The file does not provide an opt-in, alternative language, or a documented reason that the skill rules must be Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire document is written in Traditional Chinese and gives imperative instructions without indicating that language selection is optional or context-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heading '這份只管什麼' and the rest of the document are written entirely in Traditional Chinese, and the document presents the writing rules as mandatory without offering any language choice or documenting a region-specific reason. This creates a natural-language policy concern because it effectively forces a specific language/locale for skill use or documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file is written with prescriptive Chinese guidance and contains no indication that language is optional or user-selectable. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains all operational guidance exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.