Craft API Skill and Obsidian Migration Tool

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This Craft.do skill appears legitimate, but it gives an agent broad power to upload notes and make account-wide Craft workspace changes, including a cleanup script that can remove all user-created folders and documents.

Install only if you are comfortable giving the agent a Craft API key and allowing it to upload selected Obsidian notes to Craft. Use a non-critical Craft space or backup first, verify CRAFT_ENDPOINT before running scripts, and treat cleanup-craft.sh as dangerous because it is designed to remove all user-created folders and move all documents to trash.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The README documents a destructive cleanup command that 'Deletes everything' without an inline warning, confirmation requirement, scope description, or recovery caveats at the point of use. In an agent skill context, concise command examples are often copied or invoked automatically, so under-warning a bulk-deletion operation materially increases the risk of accidental data loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill repeatedly provides example commands that create folders, documents, tasks, and move content in a live Craft workspace, but the overview does not explicitly warn users that these examples will modify remote user data. This can lead to unintended writes, clutter, or accidental changes when a user copies commands assuming they are read-only examples.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script reads full markdown files from the user's Obsidian vault and sends their complete contents to a remote Craft API. While this is the stated migration behavior, there is no explicit consent prompt, dry-run mode, or clear warning that potentially sensitive notes will be transmitted off-host, which creates a real privacy and data-exposure risk if the vault contains secrets, personal notes, or regulated information.

External Transmission

Medium

• Category: Data Exfiltration

Content

local data="$3"
  
  if [ -n "$data" ]; then
    curl -s -X "$method" \
      -H "Authorization: Bearer $CRAFT_API_KEY" \
      -H "Content-Type: application/json" \
      -d "$data" \

• Confidence: 89% confidence
• Finding: curl -s -X "$method" \ -H "Authorization: Bearer $CRAFT_API_KEY" \ -H "Content-Type: application/json" \ -d

Self-Modification

High

• Category: Rogue Agent

Content

Tested: 2026-01-31
Last Updated: 2026-01-31

Found a new capability or limitation? Update SKILL.md and document your findings.

---

• Confidence: 94% confidence
• Finding: Update SKILL

VirusTotal

51/51 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.