ClawHub
Back to skill

Security audit

Obsidian Daily Log

Security checks across malware telemetry and agentic risk

Overview

This skill openly appends timestamped entries to a specified local Obsidian daily note and does not show hidden network, credential, or destructive behavior.

Install only if you want an agent to save activity timelines into the specified Obsidian vault. Check that the hard-coded Windows vault path matches your machine, and use explicit save/log wording in shared chats to avoid accidentally persisting ordinary conversation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill directs the agent to read and write local files in an Obsidian vault and invoke a local script, but it does not declare permissions or clearly constrain file access. That mismatch can hide sensitive local-file modification capability from reviewers and users, increasing the risk of unintended writes, data corruption, or abuse if the skill is triggered unexpectedly.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill is explicitly designed to modify a local Obsidian vault, but the user-facing description does not prominently warn that local files will be changed. In shared-chat or ambiguous-trigger situations, this can cause surprising persistence of private or incorrect content to disk, which is especially sensitive because the target is a personal knowledge base on the local machine.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.