Security audit

Excalidraw

Security checks for vulnerabilities and agentic risk

Overview

No malware or deceptive behavior was shown, but the skill may need path review because one scanner note says it writes to a hardcoded Obsidian vault location.

Before installing, review SKILL.md lines 10-15 and replace any hardcoded Obsidian vault path with your own chosen destination. Avoid running it unattended if it can overwrite existing notes or write without confirmation.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs output to a fixed absolute path inside a specific Obsidian vault, which can cause unintended modification of user files without requiring explicit confirmation or allowing a safer, user-chosen destination. In an agent context, hardcoded write locations are risky because the agent may overwrite existing notes or create files in a sensitive personal workspace automatically.

Static analysis

No suspicious patterns detected.