Obsidian Plugin Development

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:51 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Obsidian plugin development guide, but it asks agents to create/use a public GitHub template checkout and run unpinned third-party setup commands.

Review the referenced template repository, package scripts, lockfile, and setup scripts before allowing an agent to run them. Prefer a pinned commit or trusted fork, run setup in a constrained development environment, and explicitly approve any GitHub repo creation or public publishing step.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned third-party template and script execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–22 and 49–53
Vulnerability Type: Supply-chain exposure through an unpinned external repository and downloaded scripts
Risk Level: Medium

Vulnerable Code

bash

# Clone the template (or use GitHub's "Use this template" button)
gh repo create my-plugin --template davidvkimball/obsidian-sample-plugin-plus --public --clone
cd my-plugin

# Or clone directly
git clone https://github.com/davidvkimball/obsidian-sample-plugin-plus.git my-plugin
cd my-plugin
rm -rf .git && git init

bash

pnpm install
pnpm obsidian-dev-skills          # Initialize AI skills
./scripts/setup-ref-links.sh      # Unix
# or: scripts\setup-ref-links.bat  # Windows

Technical Analysis

The Skill directs users to retrieve the current contents of a third-party repository from a personal GitHub namespace without pinning a reviewed commit or signed release. It then instructs users to install the retrieved project's dependencies and execute commands and setup scripts originating from that external project.

Because the repository revision and dependency state are not fixed or integrity-verified, the effective code executed by these steps can change after this Skill has been reviewed. A compromise or malicious modification of the template repository, package metadata, dependency graph, lifecycle scripts, obsidian-dev-skills command resolution, or setup scripts could introduce arbitrary code execution.

The audit did not establish that the referenced repository or scripts are currently malicious. The vulnerability is the unsafe trust and execution model.

Attack Path

1. An attacker compromises the referenced repository, a maintainer account, or a dependency used by the downloaded project.
2. The attacker modifies package metadata, an installation lifecycle hook, the command resolved by pnpm obsidian-dev-skills, or one of the setup scripts.
3. A user follows the Skill and retrieves the mutable latest ...[truncated 930 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the template to a reviewed commit hash or immutable, signed release rather than cloning the default branch.

2. Document the expected repository revision and verify it immediately after retrieval.

3. Provide cryptographic checksums or signature-verification instructions for externally retrieved artifacts.

4. Audit package manifests, lockfiles, lifecycle hooks, and setup scripts before instructing users or agents to execute them.

5. Require lockfile-enforced dependency installation, such as:

   bash

   pnpm install --frozen-lockfile
   

6. Pin the package manager version and all dependency versions through a committed lockfile.

7. Avoid automatically executing scripts from a newly downloaded repository. Present their contents for review or replace them with documented, explicit setup steps.

8. Run unavoidable installation and setup operations in a restricted development container or sandbox with no unnecessary credentials and minimal filesystem access.

9. Consider vendoring a reviewed scaffold or maintaining a trusted, versioned template under controlled ownership.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: obsidian-plugin
description: Create and develop Obsidian plugins from scratch. Use when building a new Obsidian plugin, scaffolding from the sample-plugin-plus template, or developing plugin features. Covers project setup, manifest configuration, TypeScript development, settings UI, commands, ribbons, modals, and Obsidian API patterns.
---

# Obsidian Plugin Development

Static analysis

No suspicious patterns detected.