x-grok-to-obsidian

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:55 AM UTC
• Version: 0.1.1

Overview

This skill appears intended to export a user's own Grok chat history, but it captures broad authenticated conversation data and temporarily stores full payloads in browser storage with limited privacy safeguards.

Install only if you are comfortable exporting your Grok chat history from a logged-in X session. Run it on a private machine, treat the downloaded JSON and generated Markdown as sensitive, avoid committing or syncing them unintentionally, and clear the xgrok_capture_checkpoint_v1 localStorage entry if the browser capture is interrupted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export_grok_items_capture.js:31

Finding

Plaintext Persistence of Private Grok Conversation Data in Browser Storage

Content

View full analysis

Vulnerability Details

File Location: scripts/export_grok_items_capture.js, lines 31–44 and 359–372
Vulnerability Type: Plaintext storage of sensitive information
Risk Level: Medium

Vulnerable Code:

javascript

const saveCheckpoint = (targets, currentIndex, pass) => {
  try {
    const cp = {
      version: 1,
      savedAt: new Date().toISOString(),
      pass,
      currentIndex,
      targets,
      captured: [...captured.values()].map(x => ({ restId: x.restId, requestUrl: x.requestUrl, source: x.source, data: x.data })),
      rateLimitHits,
    };
    localStorage.setItem(CHECKPOINT_KEY, JSON.stringify(cp));
  } catch {}
};

javascript

// final checkpoint save before download
saveCheckpoint(targets, targets.length - 1, 3);

const blob = new Blob([JSON.stringify(out, null, 2)], { type: 'application/json' });
const a = document.createElement('a');
a.href = URL.createObjectURL(blob);
a.download = `grok-conversation-history-${Date.now()}.json`;
a.click();

// completed successfully; clear resume state
clearCheckpoint();

Technical Analysis

The checkpoint mechanism serializes complete captured API response objects into plaintext localStorage under the X origin. These objects may contain private conversation messages, reasoning traces, conversation metadata, and request URLs.

Browser localStorage is persistent and is not automatically cleared when the tab closes or the browser restarts. The script removes the checkpoint only after reaching its successful completion path. If execution is interrupted by tab termination, browser failure, navigation, an unhandled exception, or manual cancellation, the captured information may remain stored indefinitely.

Any JavaScript that subsequently gains execution capability in a context permitted to access the same origin storage can retrieve the checkpoint through its fixed key, xgrok_capture_checkpoint_v1. This ...[truncated 1570 chars]

Remediation

View remediation

Remediation Suggestions

1. Store only nonsensitive resume metadata in localStorage, such as conversation IDs, the current index, pass number, and completion status. Keep message bodies and complete response objects in memory.

2. If payload persistence is operationally required, obtain explicit user consent and use a safer user-controlled export mechanism instead of origin-wide plaintext storage.

3. Add a short expiration timestamp to checkpoints and delete expired data automatically when the script starts.

4. Provide and document a manual cleanup command:

   javascript

   localStorage.removeItem('xgrok_capture_checkpoint_v1');
   

5. Wrap the main workflow with robust cleanup handling where appropriate. Distinguish resumable interruptions from terminal failures, and delete sensitive payloads when continuation is not intended.

6. Minimize checkpoint contents by excluding full API responses, reasoning traces, citations, and request URLs unless strictly necessary for resume functionality.

7. Clearly warn users that interrupted runs may leave sensitive data in browser storage and explain how to remove it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code substantially matches the first half of the description: it operates on x.com/i/grok, opens chat history, scrolls/indexes conversations, captures Grok conversation payloads from browser network traffic, and exports the results. However, the declared purpose explicitly says it converts the captured JSON into Obsidian-ready Markdown files with YAML frontmatter preserving turns. This code never renders Markdown, creates per-note files, or emits YAML frontmatter; it only normalizes the captured API payload and downloads a single JSON file. That is a material description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This skill is explicitly designed to extract conversation data from an authenticated X/Grok session, so the context-leakage concern is real even if that is the intended function. Because the captured data comes from private chats and backend responses, misuse or poor handling could expose sensitive prompts, responses, metadata, or account-linked information.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

Export Grok conversations in two stages.

## Stage 1 — Capture conversation JSON from X/Grok

Run the browser script in Chrome DevTools Console on `https://x.com/i/grok` while logged in.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

Use script: `scripts/export_grok_items_capture.js`

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/convert_grok_capture_to_md.py (reported line 107)May include surrounding context.

python

ap.add_argument('--out', default='.', help='Output folder (default: current directory)')
    ap.add_argument('--include-reasoning', action='store_true', help='Include thinking_trace blocks')
    ap.add_argument('--separator', default='---', help='Turn separator line')
    ap.add_argument('--overwrite', action='store_true', help='Overwrite existing files with same title')
    args = ap.parse_args()

    src = Path(args.input).expanduser().resolve()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to capture authenticated Grok/X conversation data from browser network traffic and save it to disk, but it does not prominently warn that the resulting JSON may contain sensitive personal content and potentially sensitive metadata from an authenticated session. In a data-export skill, that omission increases the chance of accidental disclosure, unsafe sharing, or insecure storage of private conversation archives.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs use of browser-based capture plus a local Python converter, implying network access and read/write handling of sensitive conversation exports, but it declares no explicit tool scope or permission boundaries. That omission increases the chance an agent or user runs the skill without understanding that authenticated private data will be accessed and written to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells users to run a DevTools script while logged into x.com/i/grok, which will capture private Grok conversation data from an authenticated session and download it locally, but it does not prominently warn about that sensitivity. Users may unknowingly export highly sensitive personal or proprietary chat history and store it insecurely on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes conversation content directly to Markdown files on disk, including optional thinking_trace data, without any warning, confirmation, or safeguard about sensitive data persistence. In this skill context, the captured Grok conversations may contain private prompts, account-linked URLs, or sensitive reasoning content, so silently exporting them increases the risk of unintended disclosure via local storage, sync, backup, or sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script saves captured Grok conversation contents, including full payload data, into localStorage checkpoints and later into a downloadable JSON export. Because localStorage is readable by any script running on x.com in the same browser profile, sensitive chat history may be exposed to other scripts, browser extensions, or a shared machine user, and the script provides no explicit warning or consent flow before persisting that data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script monkey-patches fetch and XMLHttpRequest to intercept responses from Grok conversation endpoints and copies the returned JSON into an internal collection for later export. In the context of a data-export skill this appears functional rather than overtly malicious, but it still captures potentially sensitive conversation data at the network layer without explicit in-script disclosure, increasing privacy and misuse risk if a user pastes and runs it without fully understanding what is collected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.