ClawHub
Back to skill

Security audit

Obsidian-Git-Vault

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Obsidian note-vault helper that edits Markdown files and runs Git sync commands, with higher-risk actions generally gated by user consent.

Install this only if you want an agent to manage an Obsidian Markdown vault with Git. Before edits or syncs, verify the resolved vault path, review Git status/diffs before commits or pushes, use narrow SSH/PAT permissions, and enable the recurring cron sync only if you know how to disable it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The activation text is extremely broad, covering common terms like notes, Git, push/pull, remote, sync, and vault, which increases the chance the skill is invoked in conversations where the user did not intend filesystem or Git operations. In a skill that can create files, modify notes, initialize repositories, and configure remotes, unintended activation raises the risk of accidental state-changing actions.

Session Persistence

Medium
Category
Rogue Agent
Content
3. 当前 Cursor **工作区根目录**：若根下存在 `.obsidian` 目录，可视为 vault 根。
4. **约定默认目录**：`~/.openclaw/workspace/obsidian-git-vault`（即 `$HOME/.openclaw/workspace/obsidian-git-vault`）在磁盘上已存在时作为 vault 根。

若以上皆无效：向用户索要 vault 绝对路径，或说明可 `mkdir -p ~/.openclaw/workspace/obsidian-git-vault` 后作为默认库再操作。禁止把上述列表以外的路径当作默认去猜。禁止操作落在所选 vault 根以外的未授权路径（防路径穿越）。

下文记 `V="<vault 绝对路径>"`，命令统一写 `git -C "$V"`。
Confidence
87% confidence
Finding
mkdir -p ~/.openclaw/workspace/obsidian-git-vault` 后作为默认库再操作。禁止把上述列表以外的路径当作默认去猜。禁止操作落在所选 vault 根以外的未授权路径（防路径穿越）。 下文记 `V="<vault 绝对路径>"`，命令统一写 `git -C "$V"`。 ### 1.1 默认 `.gitignore` 不单独提供 `default.g

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| 撤销未提交修改 | `git restore 路径`（丢弃工作区改动前需用户确认） |
| 取消暂存 | `git restore --staged 路径` |

**高风险**：`git reset --hard`、裸 `git push --force`、`git rebase` 等——默认仅用户 **逐字明确要求** 时执行。若用户 **已采用** [vault-sync-sop.md](vault-sync-sop.md)，则其中写明的「本地领先时推送 / `push --force-with-lease`」条件 **优先于** 本句的保守默认。

不要直接编辑 `.git` 目录内文件；不把 `.git` 当笔记检索。
Confidence
96% confidence
Finding
git push --force`、`git rebase` 等——默认仅用户 **逐字明确要求** 时执行。若用户 **已采用** [vault-sync-sop.md](vault-sync-sop.md)，则其中写明的「本地领先时推送 / `push --force

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| 撤销未提交修改 | `git restore 路径`（丢弃工作区改动前需用户确认） |
| 取消暂存 | `git restore --staged 路径` |

**高风险**：`git reset --hard`、裸 `git push --force`、`git rebase` 等——默认仅用户 **逐字明确要求** 时执行。若用户 **已采用** [vault-sync-sop.md](vault-sync-sop.md)，则其中写明的「本地领先时推送 / `push --force-with-lease`」条件 **优先于** 本句的保守默认。

不要直接编辑 `.git` 目录内文件；不把 `.git` 当笔记检索。
Confidence
96% confidence
Finding
git reset --hard

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.