ClawHub
Back to skill

Security audit

Obsidian Clipper

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: fetches user-provided web content and saves Markdown notes into an Obsidian vault, with a few setup and privacy cautions.

Before installing, edit or verify config.json so the vault path and collector name are yours. Use explicit save-to-Obsidian commands, and do not submit confidential, private, intranet, or tokenized URLs unless you are comfortable with the available fetch/search/browser tools accessing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases include very generic terms such as '收藏', '归档', 'clip', and 'save to obsidian', which can overlap with ordinary user conversation and cause the skill to activate outside its intended scope. In a skill that reads configuration, fetches remote content, and writes files into a local Obsidian vault, accidental invocation can lead to unintended network access and file creation or modification.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.