Security audit
Security checks for vulnerabilities and agentic risk
The skill’s note-making purpose is coherent, but it defaults to persisting and syncing potentially sensitive documents to a hardcoded Obsidian location without clear per-run consent.
Review this skill before installing. Use it only if you are comfortable with extracted content being written to local markdown files and synced to an Obsidian vault, and update or remove the hardcoded vault path before use. Require explicit confirmation before processing medical, financial, business, or private documents.
The documented behavior does not match the implemented behavior: the skill claims generic extraction and safe note handling, but the actionable path includes a hardcoded sync target and lacks real extraction/saving safeguards. Description-behavior mismatches are dangerous because reviewers and users may grant trust based on stated purpose while hidden or underspecified behaviors move data to unintended locations.
The skill instructs file writing and shell execution but declares no explicit tool scope or permission boundaries. That makes the effective capability set ambiguous and increases the chance an agent can write arbitrary files or invoke subprocesses without clear user consent or enforcement.
The skill defaults to saving extracted content locally and auto-syncing it to Obsidian without disclosing privacy implications. Since the content may include sensitive documents, lab results, screenshots, or business materials, silent persistence and sync can cause unintentional exposure or retention of confidential data.
The skill directs execution of an external Python script via shell, which expands the attack surface beyond simple content transformation. Any subprocess call can introduce command injection risk, unreviewed script behavior, environment abuse, or unintended file/network access, especially when paired with user-influenced file paths.
The module docstring and usage examples present this script as converting URLs, PDFs, and images into structured markdown notes. In actual code, main() only parses arguments and prints messages, while no extraction, note creation, saving, or syncing is invoked; extract_url_content() is a placeholder that returns a comment string.
The extract_url_content docstring states it extracts content from a URL and returns markdown content. The implementation explicitly does not do that and instead returns a placeholder string, directly contradicting the documented behavior.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
subfolder
]
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode == 0:
print(f"\n✅ Synced to Obsidian: {subfolder}/{filepath.name}")
The skill tells the agent to fetch user-provided URLs but does not warn that this causes outbound requests to third-party servers. This can leak user interest, internal URLs, or tracking metadata, and can be more serious if users provide private or intranet links.
No suspicious patterns detected.