Security audit
Security checks for vulnerabilities and agentic risk
The skill appears purpose-built for Craft.do automation, but it uses a powerful API token for bulk uploads and destructive changes while trusting any configured endpoint URL.
Install only if you trust the publisher and will use a narrowly scoped, revocable Craft API key. Verify CRAFT_ENDPOINT is the official HTTPS Craft endpoint before every run, back up/export important Craft and Obsidian data first, and avoid running the migration or cleanup scripts unattended.
craft-api.sh:8Bearer Token Can Be Sent to an Untrusted Configurable Endpoint
craft-api.sh:64Command-Line and Filesystem Values Are Interpolated Directly into JSON Payloads
migrate-obsidian-nested.sh:75Obsidian Folder Names Are Evaluated as jq Program Text
migrate-obsidian.sh:50Migration Scripts Use Predictable Non-Atomic Files in Shared Temporary Storage
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Tested: 2026-01-31
Last Updated: 2026-01-31
Found a new capability or limitation? Update SKILL.md and document your findings.
---
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
This skill provides **complete Craft.do API integration** for agents and automation:
- **One-time migration:** Move your entire Obsidian vault to Craft with full hierarchy
- **Ongoing automation:** Create tasks, organize documents, manage content programmatically
- **Helper utilities:** Ready-to-use scripts for common Craft operations
- **Safe & tested:** Production-ready with duplicate prevention and cleanup tools
The README instructs users to run a destructive cleanup command that 'Deletes everything' without clearly stating scope, recovery limits, or whether the script prompts for confirmation. In an automation skill, users may copy-paste commands directly, so understated destructive operations materially increase the risk of accidental mass deletion of Craft content.
The skill prominently advertises create, update, move, and migration capabilities against user documents, folders, and tasks, but it does not provide an upfront warning that executing these commands will modify remote user data. In an agent setting, this increases the risk of unintended destructive or irreversible changes because users may invoke examples without clear awareness of write-side effects.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -H "Authorization: Bearer $CRAFT_API_KEY" \
"$CRAFT_ENDPOINT/folders"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Push each to Craft
echo "$COMPLETED_TASKS" | while read -r task; do
curl -X POST \
-H "Authorization: Bearer $CRAFT_API_KEY" \
-H "Content-Type: application/json" \
-d "{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"$CRAFT_ENDPOINT/folders" | jq -r '.id')
# 2. Create a project document
DOC_ID=$(curl -X POST \
-H "Authorization: Bearer $CRAFT_API_KEY" \
-H "Content-Type: application/json" \
-d "{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"$CRAFT_ENDPOINT/folders" | jq -r '.id')
# 2. Create a project document
DOC_ID=$(curl -X POST \
-H "Authorization: Bearer $CRAFT_API_KEY" \
-H "Content-Type: application/json" \
-d "{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
TASK_ID=$(curl -H "Authorization: Bearer $CRAFT_API_KEY" \
"$CRAFT_ENDPOINT/tasks?scope=active" | jq -r '.items[0].id')
curl -X PUT \
-H "Authorization: Bearer $CRAFT_API_KEY" \
-H "Content-Type: application/json" \
-d "{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
local data="$3"
if [ -n "$data" ]; then
curl -s -X "$method" \
-H "Authorization: Bearer $CRAFT_API_KEY" \
-H "Content-Type: application/json" \
-d "$data" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
local data="$3"
if [ -n "$data" ]; then
curl -s -X "$method" \
-H "Authorization: Bearer $CRAFT_API_KEY" \
-H "Content-Type: application/json" \
-d "$data" \
The move command performs a state-changing operation on user documents by relocating them, but the script provides no confirmation prompt and no explicit warning that it will alter document organization. While the command name hints at its purpose, there is no user disclosure beyond terse usage text about the impact of the action.
This helper wraps curl calls to an externally supplied endpoint using a bearer token and is later used to transmit folder metadata and document contents off-host. External transmission is expected for a migration script, but it still represents a real data-exfiltration boundary, especially because the endpoint is configurable via environment variable and there is no validation or allowlist to ensure data only goes to the legitimate Craft service.
local data="$3"
if [ -n "$data" ]; then
curl -s -X "$method" \
-H "Authorization: Bearer $CRAFT_API_KEY" \
-H "Content-Type: application/json" \
-d "$data" \
The script reads each markdown file and sends its full contents to the remote Craft API, but it does not present an explicit warning, confirmation, or scoping control before transmitting potentially sensitive vault data. Because Obsidian vaults often contain private notes, credentials, or personal records, silent bulk upload creates a real confidentiality risk if the user does not fully understand the disclosure.
This helper centralizes authenticated outbound HTTP requests using curl with a bearer token, enabling transmission of vault metadata and document contents to whatever URL is placed in CRAFT_ENDPOINT. While external transmission is expected for a migration tool, the implementation does not constrain or validate the destination, so a mis-set or malicious endpoint can exfiltrate all migrated content and the API token to an attacker-controlled service.
local data="$3"
if [ -n "$data" ]; then
curl -s -X "$method" \
-H "Authorization: Bearer $CRAFT_API_KEY" \
-H "Content-Type: application/json" \
-d "$data" \
The script reads each markdown file from the local Obsidian vault and uploads its full contents to a remote Craft API, but it provides only generic migration messaging and no explicit, prominent warning that potentially sensitive notes will be transmitted off-host. In a note-taking vault, content commonly includes private personal, business, or credential-adjacent information, so silent bulk export materially increases the risk of unintended data disclosure if the endpoint is misconfigured, untrusted, or broader than the user expects.
Earlier documentation states that documents are created without content initially and that content must be added via the /blocks endpoint (L091-L109). The 'Create Daily Note' example instead creates a document with inline content and location fields in the document payload, which conflicts with the described API usage and intent of the skill documentation.
The main API documentation says documents are created without content initially and content should be added later through /blocks (L075-L109, especially L091). In the workflow example, the document creation request includes content and a direct location field, which actively conflicts with the earlier guidance about how document creation works.
No suspicious patterns detected.