Get笔记筛选整理助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 2.0.0

Overview

The skill is a coherent Obsidian note organizer, but it asks for broad vault read/write access, possible automatic scans, and a global unpinned CLI install without strong user-control safeguards.

Install only if you intend to let this skill read and potentially write your Obsidian vault. Prefer a pinned, local vaultctl install, restrict access to the intended vault folder, disable any automatic weekly scanning unless you explicitly opt in, and require a path plus content preview before any note or index file is created or changed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Global Installation of a Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-33
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

npm install -g vaultctl
vaultctl config set vault "g:\笔记\喜悦天地"

Technical Analysis

The installation instructions globally install the third-party vaultctl npm package without specifying an exact version. The project does not include a lockfile, integrity hash, verified package provenance, or vendored implementation.

Consequently, the installed package is determined by the registry state at installation time rather than by the version reviewed with this Skill. npm package installation can execute package lifecycle scripts, including installation-time scripts, with the privileges of the invoking user. Global installation also places the package outside an isolated project environment and makes it available system-wide.

This creates a software supply-chain risk: if the package, its publisher account, or one of its transitive dependencies is compromised, following the documented installation command could execute attacker-controlled code. The audit did not establish that vaultctl is currently malicious; the vulnerability is the unpinned and globally scoped installation process.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a transitive dependency, or causes an unsafe release to become the registry's default version.
2. A user or agent follows the instructions in SKILL.md.
3. npm install -g vaultctl resolves the package version from the registry at installation time.
4. npm downloads the package and may execute attacker-controlled lifecycle scripts with the invoking user's privileges.
5. The installed executable can subsequently run when the Skill invokes vaultctl.
6. Malicious code could access data available to the user, including the configured Obsidian vault, and could modify other resources permitted by that account ...[truncated 665 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin vaultctl to an exact version that has been reviewed:

   bash

   npm install --save-exact vaultctl@<reviewed-version>
   

2. Prefer a project-local installation over a global installation. Commit the generated lockfile so dependency resolution is reproducible.

3. Verify the package publisher, official registry location, release provenance, and integrity before installation.

4. Use npm integrity metadata and a trusted internal registry or approved package mirror where appropriate.

5. Review transitive dependencies and package lifecycle scripts. Disable lifecycle scripts during installation when compatible with the package:

   bash

   npm install --ignore-scripts --save-exact vaultctl@<reviewed-version>
   

6. Run the tool under a non-administrative account with filesystem access limited to the required vault directory.

7. Document the expected package version and checksum in SKILL.md, and require security review before updating either value.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrase "整理一下" is extremely broad and likely to appear in ordinary conversation unrelated to this skill. That creates a high risk of unintended activation, causing the agent to read notes, query the Obsidian vault, or generate batch reports without the user explicitly requesting this skill’s sensitive behaviors.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

All user-facing instructions, triggers, and examples are written in Chinese, which effectively imposes a language expectation without an explicit opt-in or justification. Under the policy, forcing a specific language without offering user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly supports writing generated notes into the user's Obsidian vault, but it does not prominently require informed user consent at the point of action or clearly separate analysis from modification. This can lead to unintended file creation or content changes in a personal knowledge base, especially when combined with broad triggers and optional automatic workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This JSON manifest-like file uses Chinese for topic names, categories, and summaries throughout, but does not indicate that the skill is region-specific or that users can opt into this locale. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a concern even in config content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.