Security audit

obsidian-llm-wiki

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible Obsidian knowledge-base helper, but its security claims understate command execution, dependency installation, and overwrite behavior users should review carefully.

Review before installing. Use this only on a backed-up vault, avoid running the initializer on an existing non-empty vault unless you accept overwrites, and install any extractor dependencies in an isolated environment with pinned versions where possible. Be aware that despite the skill's Security section, it can run local commands and third-party tools and may fetch content from network URLs you provide.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/init-wiki.sh:173
Finding: Existing Vault Index Is Unconditionally Overwritten During Initialization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/init-wiki.sh:173-219` **Vulnerability Type**: Uncontrolled file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash # 创建 index.md echo "" echo -e "${CYAN}=== 创建 index.md ===${NC}" cat > "$VAULT_PATH/index.md" << EOF # 知识库索引 _Last updated: $DATE_ --- ## 实体页 > 人物、组织、概念、工具等 | Page | Summary | Updated | |------|---------|---------| --- ## 主题页 > 研究主题，知识领域 | Page | Summary | Updated | |------|---------|---------| --- ## 素材摘要 > 每个消化过的素材都有一篇摘要 | Page | Summary | Updated | |------|---------|---------| --- ## 对比分析 | Page | Summary | Updated | |------|---------|---------| --- ## 综合分析 | Page | Summary | Updated | |------|---------|---------| EOF echo -e "${GREEN}[CREATE] index.md${NC}" ``` The same unsafe overwrite pattern is also used for `README.md` at line 138 and `log.md` at line 224. ### Technical Analysis The shell redirection operator `>` opens the destination with truncation enabled. Therefore, initialization against an existing vault destroys the previous contents of `index.md` without checking whether the file exists, requesting confirmation, creating a backup, or requiring an explicit force option. The destination is also not checked with `-L` or an equivalent non-following filesystem operation. If `index.md` is a symbolic link, shell redirection follows the link and truncates its target. Path quoting prevents shell argument injection, but it does not prevent destructive overwrites or symbolic-link traversal. The script explicitly accepts an existing vault and skips existing directories, which may lead users to expect similarly non-destructive handling of existing files. ### Attack Path 1. A user selects an existing Obsidian vault as `VAULT_PATH`. 2. The vault already contains a populated `index.md`, or an attacker with write access to the vault places a symbolic link at that path. 3. The user runs `scripts/init-wiki.sh` with their normal filesystem privileges. 4 ...[truncated 692 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Refuse to overwrite existing files by default: ```bash if [[ -e "$VAULT_PATH/index.md" || -L "$VAULT_PATH/index.md" ]]; then echo "[ERROR] index.md already exists; use --force to replace it." >&2 exit 1 fi ``` 2. Add an explicit `--force` option and require informed confirmation before destructive replacement. 3. Reject symbolic links for every generated destination, including `README.md`, `index.md`, `log.md`, and template files. 4. Preserve existing files by creating timestamped backups before an authorized overwrite. 5. Write to a securely created temporary file in the same directory and atomically rename it after successful generation. 6. Apply the same controls to template copying, which currently uses `cp` without a no-clobber policy. 7. Consider refusing to initialize a non-empty vault unless the user explicitly selects a merge or replacement mode. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:469
Finding: Third-Party Tools Are Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:469-475` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown | 依赖 | 安装方式 | 备注 | |------|---------|------| | youtube-transcript-api | `pip install youtube-transcript-api` 或 `<env> pip install youtube-transcript-api` | 视频字幕提取 | | wechat-article-to-markdown | `uv tool install wechat-article-to-markdown` 或 `pip install wechat-article-to-markdown` | 微信公众号文章提取 | | baoyu-url-to-markdown | `bun install <package>` | 通用网页提取 | **环境说明：** - `<env_name>` — 替换为你的 Python 环境名（如 `manti`、`base` 等） - 示例：`pip install youtube-transcript-api` 或 `<env_name> pip install youtube-transcript-api` ``` ### Technical Analysis The installation commands do not pin reviewed package versions, verify artifact hashes, identify trusted package sources, or use a committed lockfile. Consequently, package managers resolve whatever release is current when installation occurs. The Bun instruction is additionally ambiguous because it uses the placeholder `<package>` instead of an exact reviewed package identity. A user or agent could substitute an incorrect, similarly named, or malicious package. Python and JavaScript package installation may execute package build hooks or lifecycle scripts. A compromised upstream release, account takeover, dependency confusion event, or typosquatted substitution can therefore result in code execution under the installing user's account. This finding does not establish that the named packages are currently malicious. It identifies an unsafe dependency acquisition process that leaves the effective installed code outside the audited artifact. ### Attack Path 1. An agent or user follows the dependency setup instructions in `SKILL.md`. 2. The package manager queries its configured registry without a pinned version or verified hash. 3. An attacker publishes or compromises a resolved package release, transitive dependency, or simila ...[truncated 743 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a specifically reviewed version. 2. For Python packages, use a requirements or lock file with cryptographic hashes, for example: ```text youtube-transcript-api==<reviewed-version> --hash=sha256:<verified-hash> wechat-article-to-markdown==<reviewed-version> --hash=sha256:<verified-hash> ``` 3. Identify the exact Bun package and pin its version instead of using `<package>`. 4. Commit the relevant lockfile and require immutable or frozen-lockfile installation. 5. Document the expected official registry and upstream repository for each package. 6. Review direct and transitive dependencies before updating pinned versions. 7. Install extraction tools in an isolated, least-privileged environment without access to unrelated credentials or sensitive files. 8. Correct the statement that the Skill has “no external code execution,” because the documented workflow runs a bundled shell script and third-party extraction tools. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The skill instructs execution of multiple external commands and scripts against user-supplied URLs and paths, expanding the attack surface well beyond simple vault management. Because these tools are external and some arguments come from untrusted input, the skill can trigger unintended code execution, unsafe parsing, network exfiltration, or harmful filesystem side effects through dependent tooling.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The security section claims there is no external code execution, yet the documented workflows explicitly call shell commands, CLI utilities, and helper scripts. This kind of false security assertion is dangerous because it can cause operators and downstream systems to apply weaker scrutiny to a skill that actually performs command execution and network-capable processing.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill states it only reads and writes inside the vault, but elsewhere it documents access to local source files, skill-bundled templates, temporary files, and a state file in the user's home directory. Misrepresenting the filesystem scope increases risk because users may authorize the skill under the false assumption that it cannot touch data outside the vault boundary.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The natural-language instructions, trigger conditions, and workflow guidance are presented exclusively in Chinese, which effectively forces a specific language/locale for use of the skill. The file does not offer an opt-in language choice or explain that the skill is intentionally restricted to a Chinese-speaking or region-specific context.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest frames the skill as a local knowledge-base construction and vault management system, but the documented behavior includes active retrieval from web URLs, WeChat articles, YouTube, X/Twitter, and other online sources via external tools. Network access may be a practical implementation detail for supported web sources, but the manifest does not clearly state that the skill itself performs external content acquisition rather than only organizing user-provided materials.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The template headings and content placeholders are written entirely in Chinese, which implies the skill output is constrained to a specific language by default. The file does not offer a language choice or explain a justified region-specific requirement, which matches the policy's language/locale violation criterion.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The markdown template hard-codes section headings and labels in Chinese, such as '概述', '关键要点', and '来源'. This imposes a specific language/locale on generated content without offering a user choice or documenting that the template is intended only for a Chinese-language context.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The script’s user-facing documentation and prompts are entirely in Chinese, including usage examples and interactive instructions. This effectively fixes the interaction language without any opt-in or alternative locale, which is a natural-language locale policy concern under the stated rules.

Natural-Language Policy Violations

Low

Confidence: 98% confidence
Finding: This markdown template uses Chinese headings and content labels throughout, which imposes a specific language on users by default. The file does not offer an alternative language choice or explain that the template is intended only for a Chinese-language context.

Static analysis

No suspicious patterns detected.