Security audit

Obsidian Tasknotes

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned, but it can modify/delete Obsidian task data and has a concrete URL construction flaw that could leak the TaskNotes API token if its environment settings are tampered with.

Review this before installing if your Obsidian tasks contain sensitive information. Use a trusted vault .env, keep TASKNOTES_API_PORT as a simple numeric localhost port, set a limited TaskNotes token if possible, and avoid letting an agent delete tasks without explicit confirmation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/tasks.py:24
Finding: Unvalidated API Port Allows Request Redirection and Bearer Token Disclosure
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/tasks.py:2
Finding: Unpinned Runtime Dependencies Create a Supply-Chain Integrity Risk
Content: View full analysis
=3.11" # dependencies = ["requests", "python-dotenv"] # /// ``` ### Technical Analysis The inline `uv` metadata declares `requests` and `python-dotenv` without exact versions, hashes, or a corresponding reviewed lockfile. Consequently, the documented `uv run` workflow may resolve different package versions over time. This makes execution dependent on the current state of the configured package index. A compromised upstream release, package-index account, mirror, or dependency chain could introduce code that was not part of the audited project. Third-party package code executes with the same operating-system identity and environment access as the CLI when installed or imported. The audit found no evidence that the currently named packages are malicious. The finding concerns the absence of reproducible, integrity-controlled dependency resolution. ### Attack Path 1. An upstream package, transitive dependency, package-index account, or configured package mirror is compromised. 2. A malicious or altered version becomes eligible under the unrestricted dependency declarations. 3. A user follows the documented command and runs `uv run scripts/tasks.py ...`. 4. `uv` resolves and downloads the eligible dependency version. 5. Malicious code executes during package installation or module import with the privileges of the user running the Skill. ### Impact Assessment Compromised dependency code would execute within the CLI process and could access resources available to that user. These may include environment variables, the TaskNotes API key, accessible files, task data, and network connectivity. The ultimate scope depends on the privileges of the invoking account and its environment. The project does not itself request elev ...[truncated 118 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tasks.py (reported line 32)May include surrounding context.
python
import requests from dotenv import load_dotenv # Load .env from vault root SCRIPT_DIR = Path(__file__).parent VAULT_ROOT = SCRIPT_DIR.parent.parent.parent.parent load_dotenv(VAULT_ROOT / ".env")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tasks.py (reported line 35)May include surrounding context.
python
# Load .env from vault root SCRIPT_DIR = Path(__file__).parent VAULT_ROOT = SCRIPT_DIR.parent.parent.parent.parent load_dotenv(VAULT_ROOT / ".env") API_KEY = os.getenv("TASKNOTES_API_KEY") API_PORT = os.getenv("TASKNOTES_API_PORT", "8080")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents use of environment variables and localhost network access but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent may invoke code, read env-backed secrets, or access local HTTP services without clear user-visible constraints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill exposes a delete operation for task files but provides no warning, safeguard, or confirmation requirement. Because this action permanently removes task data from the user's Obsidian vault via the plugin API, accidental or mis-triggered use can cause irreversible data loss.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
## When to Use - "create a task for X" → create task - "show my tasks" → list all tasks - "show in-progress tasks" → list --status in-progress - "mark X as done" → update task status to done

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrases are broad and conversational, such as 'show my tasks' and 'what should I work on,' which can cause the skill to activate in situations where the user did not explicitly intend TaskNotes operations. In an agent setting, overbroad invocation increases the chance of unintended reads or task modifications, especially when paired with update and delete capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The delete command issues a DELETE request for a task, which is a destructive operation, but the code provides no confirmation prompt before executing it. The surrounding help text and docstrings also do not warn that this action removes task data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.