Obsidian Memory System

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:46 AM UTC
• Version: 1.3.0

Overview

The skill is a coherent Obsidian memory setup, but it recommends high-impact Discord and command-execution settings that need careful review before installation.

Install only if you are comfortable maintaining a persistent agent memory vault and reviewing the OpenClaw/Discord configuration yourself. Do not use the documented full tools, exec security full, or ask off settings on a normal machine or Discord-facing bot; use least privilege, keep command approvals on, avoid Administrator Discord permissions, restrict bot channels/users, and run any sync job as an unprivileged user with backups and logging.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/openclaw-config.md:30

Finding

Unrestricted and Confirmation-Free Command Execution

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/discord-setup.md:444

Finding

Discord Setup Recommends Excessive Bot Permissions and Privileged Intents

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Warning

• Location: references/discord-setup.md:382

Finding

Persistent Cron Synchronization Performs Unattended Destructive Deletion

Content

View full analysis

/dev/null ``` ```bash */30 * * * * /root/clawd/scripts/sync-memory.sh >/dev/null 2>&1 ``` ### Technical Analysis The documentation recommends installing a cron job that executes indefinitely every 30 minutes. Scheduled execution is relevant to keeping copied memory files synchronized, but the implementation performs destructive operations without runtime validation: - `rsync --delete` removes destination files not found in the source. - `rm -rf` recursively deletes the `.dreams` path without verifying canonical paths, ownership, or symlink state. - The example uses `/root/clawd`, implying execution in a root-owned workspace and potentially execution by root. - Standard output and standard error are discarded, reducing visibility into failures and deletion events. - The script's ownership and write permissions are not hardened before it is entrusted to cron. A simple fixed path reduces direct command-injection exposure, but path manipulation, workspace replacement, symlink behavior, accidental configuration changes, or unauthorized modification of the scheduled script can turn the recurring task into a repeated destructive action. The job also creates a persistence mechanism: any malicious modification to the script will execute automatically on every schedule. ### Attack Path 1. A user creates the documented script and installs the cron entry. 2. The script or a relevant workspace path remains writable by an account or process that becomes compromised. 3. An ...[truncated 1296 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guidance explicitly configures tools.profile: "full", exec.security: "full", and exec.ask: "off", giving a Discord-connected agent unrestricted tool use and direct command execution without confirmation. In a skill whose purpose is memory and workspace setup, this is over-privileged and materially increases the chance that a prompt, compromised channel, or user mistake leads to arbitrary local command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation normalizes unsafe execution settings by stating the agent can use all tools, execute commands directly, and do so without asking, but provides no prominent safety warning or compensating controls. This can lead operators to deploy an internet-facing or chat-driven agent with effectively unsupervised command execution, making prompt injection and accidental destructive actions far more likely.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The documented rm -rf "$WORKSPACE/memory/.dreams" is a destructive operation embedded in an automation example. Although narrowly targeted as written, recursive forced deletion in copy-paste guidance is hazardous because path mistakes, variable changes, or later edits can turn it into unintended data loss, especially when run unattended via cron.

Content

Scanner excerpt · references/discord-setup.md (reported line 386)May include surrounding context.

WORKSPACE="/root/clawd" rsync -a --delete "$WORKSPACE/vault/10-journal/" "$WORKSPACE/memory/" cp -u "$WORKSPACE/vault/00-brain/MEMORY.md" "$WORKSPACE/MEMORY.md" rm -rf "$WORKSPACE/memory/.dreams" 2>/dev/null

text

Run via system cron every 30 minutes (matching heartbeat cadence):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/openclaw-config.md (reported line 16)May include surrounding context.

md

"memorySearch": {
        "enabled": true,
        "sources": ["memory"],
        "provider": "openai"       // Requires OPENAI_API_KEY in ~/.openclaw/.env
      },
      "compaction": {
        "mode": "safeguard"        // Preserves context during compaction

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill documents network-capable integration paths such as Discord bot connectivity and embedding-provider configuration, but it does not declare an explicit tool scope or allowed-tools boundary. That omission can cause the agent to invoke broader capabilities than a user expects, especially in a skill that also touches filesystem state and external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description includes very broad triggers like 'remember this', 'update memory', 'create journal', and 'set up discord', which are common conversational phrases that could activate the skill unintentionally. In a skill that creates files, symlinks, sync scripts, and workspace structure, accidental activation can lead to unintended persistent changes or disclosure into long-term memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup section tells the operator to run a script that initializes the vault, creates symlinks, and modifies workspace layout, but it does not prominently warn that this performs persistent filesystem changes. Because the skill manages memory, journals, scripts, and integration scaffolding, users may not appreciate the scope of modifications before executing setup.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

tools.profile: "full" grants the agent access to all tools, including ones unnecessary for the stated memory-system purpose. In the context of a Discord-integrated agent, broad tool access compounds the risk from malicious prompts, channel misuse, or compromised accounts by widening what the agent can do on the host or connected services.

Content

Scanner excerpt · references/discord-setup.md (reported line 230)May include surrounding context.

md

| `ackReactionScope: "all"` | Scope | React to every message (vs just first) |
| `autoPresence.enabled` | Bot status | Shows health in member list sidebar |
| `voice.daveEncryption` | Keep false | DAVE E2EE breaks voice receive (known bug) |
| `tools.profile: "full"` | Full tool access | Agent can use all tools without asking |
| `exec.security: "full"` | No sandbox | Agent executes commands directly |
| `exec.ask: "off"` | No confirmation | Agent doesn't ask before running commands |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The phrase 'without asking' reflects autonomous operation for sensitive tool use, removing a human checkpoint before potentially impactful actions are taken. In a chat-driven environment, that sharply increases the risk that ambiguous instructions, social engineering, or prompt injection result in unauthorized or destructive behavior.

Content

Scanner excerpt · references/discord-setup.md (reported line 230)May include surrounding context.

md

| `ackReactionScope: "all"` | Scope | React to every message (vs just first) |
| `autoPresence.enabled` | Bot status | Shows health in member list sidebar |
| `voice.daveEncryption` | Keep false | DAVE E2EE breaks voice receive (known bug) |
| `tools.profile: "full"` | Full tool access | Agent can use all tools without asking |
| `exec.security: "full"` | No sandbox | Agent executes commands directly |
| `exec.ask: "off"` | No confirmation | Agent doesn't ask before running commands |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

exec.ask: "off" disables confirmation before command execution, allowing the agent to make consequential decisions and act on them autonomously. When paired with direct Discord interaction and full execution privileges, this creates a dangerous path from untrusted chat input to immediate system actions.

Content

Scanner excerpt · references/discord-setup.md (reported line 232)May include surrounding context.

md

| `voice.daveEncryption` | Keep false | DAVE E2EE breaks voice receive (known bug) |
| `tools.profile: "full"` | Full tool access | Agent can use all tools without asking |
| `exec.security: "full"` | No sandbox | Agent executes commands directly |
| `exec.ask: "off"` | No confirmation | Agent doesn't ask before running commands |

## Custom Emoji & Status Reactions

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The cron sync script uses rsync --delete and rm -rf in an automated job without warning about destructive behavior or validating paths before deletion. If variables, paths, or directory assumptions are wrong, the job can silently remove data on a recurring schedule, turning a documentation convenience into persistent data-loss risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The setup recommends Administrator or a broad set of bot permissions that exceed what is necessary for memory journaling and documentation workflows. Excessive Discord privileges enlarge the blast radius if the bot token is leaked or the bot is induced to act maliciously, enabling actions across channels, threads, messages, and voice features.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file directly instructs appending content into persistent vault files but does not mention user notice, consent, or safeguards around modifying stored data. Because this skill is explicitly designed for long-lived memory and journaling, silent writes can create privacy, integrity, and auditability issues, especially if sensitive conversation content is stored automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The auto-logging triggers are defined using very broad conversational phrases like 'Actually...' or 'Can you also...', which are common in ordinary dialogue and can cause the agent to persist user content without clear intent or consent. In a memory system skill whose purpose is to store information across sessions, this increases the likelihood of unintended retention of sensitive, private, or irrelevant content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The reference configuration explicitly recommends full tool access, unrestricted command execution, and disabled confirmation prompts. In a skill framed around memory/Discord setup, this materially expands the agent's authority far beyond the stated purpose and would let a compromised or mistaken agent run arbitrary system commands without user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The config enables unsandboxed execution and disables approval prompts without prominently warning users about destructive system effects. That combination creates a high-risk operational posture because normal agent mistakes, prompt injection, or malicious workspace content could trigger file modification, persistence changes, or command execution automatically.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

Setting ask to off removes a user approval checkpoint for actions taken with powerful tools. In isolation this is a safety weakness rather than an exploit, but combined with full exec privileges it increases the chance that harmful autonomous actions occur without human intervention.

Content

Scanner excerpt · references/openclaw-config.md (reported line 36)May include surrounding context.

md

"profile": "full",             // Full tool access
    "exec": {
      "security": "full",          // No sandbox restrictions
      "ask": "off"                 // No confirmation prompts
    },
    "media": {
      "audio": {

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/setup-vault.sh (reported line 130)May include surrounding context.

sh

## Safety
- Don't exfiltrate private data
- Don't run destructive commands without asking
- \`trash\` > \`rm\`
- When in doubt, ask"

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest focuses on Obsidian-based memory, semantic search, self-improvement logging, and Discord workspace integration. Advertising a GEMINI_API_KEY for image, video, or music generation introduces an unrelated capability that is not supported by the stated skill purpose and broadens expected access unnecessarily.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The header comment describes a narrower scope than the script actually performs. Beyond symlinks and the learnings directory, the script writes multiple brain files, project templates, daily note templates, decision templates, and Obsidian application configuration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest does mention Discord workspace integration at the skill level, but this specific script's documented purpose is setting up the Obsidian memory vault structure, templates, and symlinks. The embedded post-install guidance expands into Discord bot creation and privileged intent enablement, which is not implemented by the script and is not necessary for local vault setup.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.