nubaby-obsidian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:38 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches Obsidian note-governance work, but it ships live-looking authentication secrets and unsafe gateway details that should be reviewed before installation.

Do not install or publish this version as-is. Rotate the exposed credentials, remove real tokens from the skill, replace them with placeholders or secret-store instructions, secure non-loopback gateway access, and patch the helper script to pass ripgrep options before `--`. Treat any install as access to private Obsidian vault content and require explicit user direction before search, edit, move, or delete operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/READONLY_GATEWAY_BOUNDARIES.md:44
• Finding: Hard-Coded Gateway and Upstream API Credentials## Vulnerability Details **File Location**: `references/READONLY_GATEWAY_BOUNDARIES.md`, lines 44–48 **Vulnerability Type**: Hard-coded authentication secrets **Risk Level**: Critical ### Vulnerable Code ```md ## Token boundary - `27133` gateway bearer: `arthur-obsidian-readonly-20260312` - `27124` plugin bearer / apiKey: `b9cf98bc7b7e074996691b54243a3154ca7b59e136c780388add760c25c5eeff` - Do not use the gateway token against `27124` - Do not use the `27124` plugin token against `27133` ``` ### Technical Analysis Two live-looking authentication credentials are stored directly in distributable Skill documentation. Any person, agent, backup service, package registry, or source-control user with access to the project can recover and attempt to reuse them. The gateway credential appears to authorize read-only access to the Arthur-OS vault. The upstream credential protects an Obsidian Local REST API service. According to `references/NETWORK_SEARCH_DESIGN_HISTORY.md`, that API can expose note creation, update, deletion, and command execution capabilities. Although the effective permissions depend on the deployed plugin configuration, disclosure of this upstream credential may therefore compromise more than read-only search. Separating the credentials by port does not mitigate disclosure because both credentials and their intended endpoints are documented together. ### Attack Path 1. An attacker obtains the Skill package, a repository checkout, an archive, or a logged copy of this documentation. 2. The attacker extracts the bearer token and API key from lines 45–46. 3. The attacker gains network access to the documented LAN gateway or upstream plugin endpoint. 4. The attacker submits the corresponding credential to port `27133` or `27124`. 5. If the credentials remain valid, the attacker accesses the capabilities exposed by the relevant service. ### Impact Assessment The gateway credential can expose note names, n ...[truncated 447 chars]
• Remediation: ## Remediation Suggestions 1. Revoke and rotate both disclosed credentials immediately. 2. Remove the credentials from the current repository and all retained history, releases, archives, logs, and mirrored Skill copies. 3. Replace real values in documentation with unambiguous placeholders, such as `GATEWAY_BEARER_TOKEN` and `OBSIDIAN_API_KEY`. 4. Load credentials at runtime from a protected secret manager, operating-system keychain, or environment file excluded from source control. 5. Use distinct, randomly generated, least-privilege credentials for the gateway and upstream service. 6. Ensure the gateway credential grants read-only access and cannot be reused against the upstream plugin. 7. Disable command execution and write operations on the upstream API unless explicitly required. 8. Implement expiration, routine rotation, access logging, rate limiting, and credential-reuse detection. 9. Add automated secret scanning to pre-commit and CI workflows.

T09 · Insecure Skill Coding Practices

Error

• Location: references/READONLY_GATEWAY_BOUNDARIES.md:8
• Finding: Bearer Authentication Documented over Plaintext LAN HTTP## Vulnerability Details **File Location**: `references/READONLY_GATEWAY_BOUNDARIES.md`, lines 8–13 and 23–24 **Vulnerability Type**: Plaintext transmission of authentication credentials **Risk Level**: High ### Vulnerable Code ```md 1. Mac Studio local endpoint: `http://127.0.0.1:27133` 2. Other nodes (5090 / 5092 / 5094 / Mac mini): `http://10.0.1.10:27133` 3. Do not use a node's own `127.0.0.1:27133` 4. Gateway health must use `/health` 5. A `not_found` response from `/` is normal 6. `27133` and `27124` use different authentication layers ### Other nodes - gateway: `http://10.0.1.10:27133` - health: `http://10.0.1.10:27133/health` ``` The bearer credential used by this endpoint is defined at line 45: ```md - `27133` gateway bearer: `arthur-obsidian-readonly-20260312` ``` ### Technical Analysis The remote LAN endpoint is explicitly documented with the unencrypted `http://` scheme while authentication relies on a bearer token. HTTP does not protect request headers or response bodies in transit. A bearer token grants access based solely on possession. A party capable of observing or redirecting LAN traffic may capture the authorization header and replay it. The same party may also inspect returned note content or modify unauthenticated transport traffic. A trusted LAN alone is not an adequate confidentiality or integrity boundary. The localhost endpoint has a smaller interception surface, but the documented `10.0.1.10` route crosses the network and is directly affected. ### Attack Path 1. A legitimate node sends an authenticated request to `http://10.0.1.10:27133`. 2. An attacker obtains a network observation position, such as a compromised LAN host, wireless access point, router, switch mirror, or successful address-resolution spoofing position. 3. The attacker captures the plaintext authorization header or redirects the connection. 4. The attacker replays the bearer token against the gateway. ...[truncated 612 chars]
• Remediation: ## Remediation Suggestions 1. Require HTTPS for every non-loopback gateway connection. 2. Use a certificate issued by a trusted internal certificate authority and enforce certificate validation on clients. 3. Prefer mutual TLS or a securely configured private overlay network when access is limited to managed nodes. 4. Reject plaintext authenticated requests rather than redirecting them, because the credential may already have been exposed before a redirect is processed. 5. Rotate the currently documented bearer token after encrypted transport is deployed. 6. Use short-lived, scoped credentials instead of a permanent shared bearer token. 7. Restrict the gateway with host firewall rules and permit only explicitly authorized source nodes. 8. Add replay resistance, access logging, rate limits, and alerts for unusual source addresses or query volumes. 9. Avoid returning credentials or sensitive authentication details from health and diagnostic endpoints.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ob_search.sh:29
• Finding: Ripgrep Option Injection through an Untrusted Search Query## Vulnerability Details **File Location**: `scripts/ob_search.sh`, lines 29–36 **Vulnerability Type**: Command option injection with potential command execution **Risk Level**: High ### Vulnerable Code ```bash skill) if [[ -z "$QUERY" ]]; then echo "usage: ob_search.sh skill <query>" >&2 exit 1 fi VAULT="$(obsidian-cli print-default --path-only)" rg -n -S "$QUERY" "$VAULT/Skills" --glob '*.md' ;; ``` ### Technical Analysis Shell quoting protects `$QUERY` from word splitting and shell metacharacter expansion, but it does not prevent the receiving program from treating the argument as an option. Because no `--` option terminator appears before the user-controlled query, a value beginning with `-` can be parsed by `rg` as a command-line option rather than as the intended pattern. This permits alteration of ripgrep behavior. In versions of ripgrep that support preprocessing, options such as `--pre` can specify an external preprocessing command. A crafted single argument using the `--option=value` form may therefore cause ripgrep to invoke an attacker-selected local command when the remaining execution conditions cause files to be processed. Even when command-executing options are unavailable or environmental conditions prevent preprocessing, option injection can still change file traversal, output behavior, resource consumption, or search semantics. The vulnerability is therefore present independently of whether a particular command-execution attempt succeeds. ### Attack Path 1. An attacker controls or influences the query supplied to `ob_search.sh skill`. 2. The attacker supplies a query beginning with a ripgrep option, potentially using an `--option=value` form. 3. The shell passes that value as one quoted argument, but ripgrep interprets it as an option because no `--` terminator was used. 4. Ripgrep applies the attacker-selected behavior instead of treating the value exclusivel ...[truncated 805 chars]
• Remediation: ## Remediation Suggestions Place all intended ripgrep options before an explicit option terminator: ```bash rg -n -S --glob '*.md' -- "$QUERY" "$VAULT/Skills" ``` Additional hardening should include: 1. Use fixed-string search with `-F` if regular expressions are not required: ```bash rg -n -S -F --glob '*.md' -- "$QUERY" "$VAULT/Skills" ``` 2. Validate query length and reject control characters to limit resource-exhaustion and output-manipulation risks. 3. If regular expressions are required, impose a reasonable query-length limit and execution timeout. 4. Apply explicit option boundaries to other command invocations receiving user-controlled arguments wherever the invoked CLI supports them. 5. Add regression tests using inputs such as `--help`, `--version`, and `--pre=value` to verify that they are treated only as search patterns. 6. Run the helper with the minimum filesystem permissions necessary to read the intended vault subtree.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a decision/governance skill for classifying where notes and documents belong in the Obsidian vault. The supplied code does not implement placement logic, categorization rules, or note-location decisions. Instead, it provides operational search utilities via obsidian-cli and ripgrep, including printing the default vault path and searching note names, content, or markdown files under Skills. While the description briefly mentions searching the vault with obsidian-cli, the primary declared purpose is governance of note placement, whereas the code is purely a search helper. That is a materially different primary behavior, so this should be flagged as a mismatch.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This documentation embeds live internal network endpoints and bearer tokens inside a governance skill whose stated purpose is note-placement, not secret distribution or operational access. Even if the gateway is intended to be read-only, disclosure of valid credentials and service topology materially lowers the barrier to unauthorized access, reconnaissance, and pivoting to adjacent services.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The document discloses bearer tokens in cleartext and explains which token maps to which service, which is direct credential exposure. In the context of a skill package that may be widely read, indexed, or reused by agents, this is especially dangerous because it enables immediate authenticated access attempts against internal services without further compromise.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description contains very broad activation triggers such as using the skill whenever working with Arthur-OS, Obsidian, creating or editing notes, or deciding where content belongs. In an agentic system, that can cause the skill to activate in ordinary conversations and grant access to search/path-discovery behaviors more often than necessary, increasing unintended data exposure from the vault.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The core instructional content is written in Traditional Chinese and presents the skill behavior in that language without indicating that language selection is optional. Under the policy, forcing a language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file's instructions are written entirely in Traditional Chinese and present the purpose and guidance in that language without offering any alternative language or user choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The document is written entirely in Traditional Chinese and presents operational rules as mandatory guidance without any indication that users may choose another language or locale. This can violate a language/locale policy when the skill is expected to be generally usable unless a locale restriction is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The heading "10 秒路由" and the rest of the document are written entirely in Traditional Chinese, which effectively forces one language for skill guidance. The file does not indicate that language selection is optional or that the locale restriction is intentional for a region-specific use case.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file is written entirely in Traditional Chinese and does not provide an opt-in, alternative language, or justification that this skill is region- or locale-specific. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The file explicitly states the gateway is not for remote control, but later reveals the upstream Obsidian plugin API token for a separate service on port 27124. That contradiction is dangerous because it normalizes trust in a read-only boundary while simultaneously exposing credentials for a more sensitive non-gateway interface, enabling misuse if that upstream service is reachable.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The document is written entirely in Traditional Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language violations, a skill that effectively requires one language without opt-in should be flagged unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file uses only Chinese for its policy/instruction content, which can amount to a language policy constraint for users or maintainers who do not read that language. The file does not provide an opt-in, alternative language, or a documented reason that the skill rules must be Chinese-only.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire document is written in Traditional Chinese and gives imperative instructions without indicating that language selection is optional or context-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The heading '這份只管什麼' and the rest of the document are written entirely in Traditional Chinese, and the document presents the writing rules as mandatory without offering any language choice or documenting a region-specific reason. This creates a natural-language policy concern because it effectively forces a specific language/locale for skill use or documentation.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This markdown file is written with prescriptive Chinese guidance and contains no indication that language is optional or user-selectable. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file contains all operational guidance exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.