obsidian-wiki

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.1

Overview

This Obsidian wiki skill has a coherent purpose, but it enables unattended reading, moving, rewriting, and package installation with weak scoping and confirmation controls.

Install only if you are comfortable with an automated agent operating on your Obsidian vault. Run it manually first, keep backups, restrict it to a dedicated vault, review logs and generated pages, and avoid placing secrets or sensitive documents in the raw folder. Do not allow unattended dependency installation or scheduled runs unless you have pinned/provisioned the required packages and confirmed path containment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:330

Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 330-345
Vulnerability Type: Unsafe dependency installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash

# Step 1: Check if Python is installed
python --version || python3 --version

# If not installed, install Python:
# macOS: brew install python
# Linux: sudo apt-get install python3 python3-pip
# Windows: Download from python.org

# Step 2: Check if required packages are installed
python -c "import pypdf" 2>/dev/null || echo "pypdf not installed"
python -c "import docx" 2>/dev/null || echo "python-docx not installed"

# Step 3: Auto-install missing packages
pip install pypdf python-docx

Technical Analysis

The Skill instructs the agent to install pypdf and python-docx automatically from the package index selected by the local pip configuration. It does not pin reviewed versions, verify package hashes, use a lockfile, specify a trusted index, or require approval before installation.

Dependency installation can execute package-controlled build or installation logic. Moreover, the subsequently imported modules execute package initialization code. The effective code installed by this instruction may therefore change after the Skill has been reviewed.

The instruction also relies on the ambiguous pip and python commands rather than invoking a known interpreter through an isolated environment. This could install packages into an unintended interpreter or environment.

Attack Path

1. A threat actor compromises a dependency release, its publisher account, or the package source configured for pip.
2. An unattended document-conversion operation determines that one or both dependencies are missing.
3. The agent executes pip install pypdf python-docx without a version or hash constraint.
4. The compromised package is downloaded and installed.
5. Malicious package logic executes during installa ...[truncated 662 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed version, preferably through a committed lockfile.
2. Require package hashes and install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
3. Configure an explicitly trusted package index or an internally controlled package mirror.
4. Create a dedicated virtual environment and invoke pip through its exact interpreter, for example venv/bin/python -m pip.
5. Require explicit user approval before the first dependency installation, particularly during unattended maintenance.
6. Separate dependency provisioning from document processing so scheduled runs cannot modify the runtime environment.
7. Scan and periodically review pinned dependencies for known vulnerabilities and unexpected ownership or release changes.
8. Run converters in a sandbox with minimal filesystem and network access.

T09 · Insecure Skill Coding Practices

Error

• Location: agents/pagecreator.md:101

Finding

Caller-Controlled Output Path Can Permit Writes Outside the Wiki Vault

Content

View full analysis

Vulnerability Details

File Location: agents/pagecreator.md, lines 101-121
Vulnerability Type: Unrestricted file path and path traversal
Risk Level: High

Vulnerable Code

json

{
  "page_type": "source|entity|concept|synthesis",
  "output_path": "~/Obsidian Wiki/wiki/10_Sources/filename.md",
  "data": {
    "title": "Page Title",
    "source_path": "raw/articles/file.md",
    "summary": "...",
    "key_points": ["..."],
    "entities": [...],
    "concepts": [...]
  }
}

text

## Procedure
1. Read existing page if it exists (for updates)
2. Merge new data with existing content
3. Update `updated` timestamp
4. Write complete page

The same agent additionally instructs implementations to create parent directories when needed, but it does not define any path validation or vault-containment requirement.

Technical Analysis

output_path is accepted directly as an input to a file-writing agent. The specification does not require the agent to reject absolute paths, parent-directory components such as .., alternative separators, symbolic-link escapes, or destinations outside ~/Obsidian Wiki/wiki/.

This creates a path traversal and arbitrary-file-write boundary violation if an attacker can influence PageCreator input through a source document, a compromised sub-agent result, prompt injection, or a malformed orchestration request. Atomic writing prevents partial writes but does not make an unsafe destination secure.

Page titles and extracted entity or concept names can also originate from untrusted source content. If an implementation derives filenames from those values without sanitization, separators or traversal components could similarly affect the destination.

Attack Path

1. An attacker gains influence over a PageCreator request, such as through an ingested document that manipulates generated page metadata or through another compromised workflow componen ...[truncated 1115 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove output_path from caller-controlled input. Derive the destination internally from a fixed vault root and an allowlisted page-type directory.
2. Sanitize generated filenames by allowing only a conservative set of characters and rejecting path separators, .., null bytes, control characters, and absolute paths.
3. Resolve both the vault root and proposed destination to canonical paths before writing.
4. Reject the operation unless the canonical destination is a descendant of the expected directory, such as ~/Obsidian Wiki/wiki/10_Sources/.
5. Protect against symbolic-link traversal by checking every existing path component and using filesystem APIs that do not follow symlinks where available.
6. Use a fixed extension such as .md and reject caller-selected extensions.
7. Create files with exclusive or explicitly controlled replacement semantics, and preserve backups when updating existing pages.
8. Apply the same validation to filenames derived from titles, entities, concepts, and source metadata.
9. Add tests covering absolute paths, nested traversal, encoded separators, symbolic links, home-directory expansion, and platform-specific path forms.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The instruction to extract context from existing mentions and create new pages from it can propagate sensitive text from one page into additional derived artifacts. In a wiki skill that processes arbitrary user documents, this increases the blast radius of any confidential information already present in source material.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md

**Auto-Fix Rules:**
1. **Orphan pages**: Read page content, add reference line in index.md under appropriate category
2. **Missing concept pages**:
   - Extract context from existing mentions
   - Create basic template page
   - Add `tags: [concept, draft]`
   - Add `> [!warning] Auto-created, needs refinement` at page top

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The auto-maintenance section explicitly enables fully automated operation with no user confirmation while scanning, moving, ingesting, and updating content. In a personal knowledge base context, unattended writes to user material create substantial integrity and privacy risk if categorization, extraction, or linking is wrong.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description says it will initialize a vault in the root directory and automatically execute file-processing behavior, but it does not prominently warn that it will create, move, rename, and rewrite user files. That can cause unexpected data modification or organization changes without informed user consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill advertises autonomous execution with automatic sub-agent orchestration and environment management. That increases risk because multiple delegated actions can occur without human review, magnifying the chance of unintended filesystem changes or unsafe setup actions.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

Workflow:
When sending files to OpenClaw, instruct it to save them in the ~/Obsidian Wiki/raw/ directory.

> **Note:** This skill utilizes parallel task descriptions ("spawn X agent for each file"), which OpenClaw automatically executes as sub-agents. It automatically manages Python environment setup and library installations to handle diverse file formats. This skill is specifically optimized for autonomous execution to align with OpenClaw's native workflow. 

## The Core Idea

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the host to check for Python, install it at the OS level, and run package installation commands, including platform-specific package manager usage. That exceeds normal wiki-maintenance scope and introduces supply-chain and system-modification risk, especially in unattended or privileged environments.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The inclusion of a sudo apt-get install path encourages privileged system changes from within a content-management skill. Even as an example, this normalizes elevation for nonessential functionality and can expose the host to unintended package installation or abuse if executed in automation.

Content

Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.

md

# If not installed, install Python:
# macOS: brew install python
# Linux: sudo apt-get install python3 python3-pip
# Windows: Download from python.org

# Step 2: Check if required packages are installed

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The PageCreator behavior explicitly says to directly write merged content with no confirmation, including handling conflicts automatically. Autonomous content mutation in a user knowledge base can corrupt notes, preserve incorrect merges, or create hard-to-audit changes at scale.

Content

Scanner excerpt · SKILL.md (reported line 485)May include surrounding context.

md

- **Auto-merge**: Append new content to existing content
  - **Handle conflicts**: Add `## Contradictions` section to document differences
  - **Update metadata**: Append source reference, update `updated` timestamp
- **No confirmation**: Directly write to file
- **Atomic write**: Complete content written at once, avoid partial writes

**Merge Strategy Example:**

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is designed to read full user files, extract entities and concepts, generate summaries, and persist them in wiki pages and logs during unattended execution. That creates a real data-retention and inadvertent disclosure risk because sensitive content may be copied, amplified, and stored in more places without review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The manual-vs-auto table clearly states that auto-maintenance is fully automated with no confirmation. In context, this means the system can make classification, merge, logging, and file-update decisions on behalf of the user without oversight, which is dangerous when operating on personal documents.

Content

Scanner excerpt · SKILL.md (reported line 743)May include surrounding context.

md

| Aspect | Manual Mode | Auto-Maintenance Mode |
|--------|-------------|----------------------|
| User confirmation | Confirm/cancel at each step | Fully automated, no confirmation |
| Uncertain category | Ask user | Use `others/` |
| Content conflicts | Discuss solutions | Log conflicts, preserve all |
| Report format | Display in conversation | Write only to log.md |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The agent is explicitly designed to read arbitrary file paths and return complete file contents, but it includes no path restrictions, user-consent checks, or warnings about sensitive data exposure. In an agentic environment, this can enable unintended access to secrets, SSH keys, tokens, configuration files, or personal documents if a higher-level prompt or tool invocation supplies a sensitive path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The agent is explicitly instructed to modify persistent files (index.md and log.md) and to always append to the log, but there is no requirement for user confirmation, explicit disclosure of side effects, or scoping checks before writes. In a wiki-maintenance skill this behavior is expected, but it still creates a real safety issue because an invoking workflow could cause silent, unintended changes to user knowledge-base files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to read, create, update, and overwrite wiki pages and to create parent directories, but it provides no user-facing warning, confirmation step, or scope restriction for those file modifications. In an agent setting, this can lead to unintended or unauthorized changes to a user's Obsidian vault, especially if inputs or output paths are influenced by untrusted data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The auto-maintenance categorization rules hard-code English and Chinese keywords for classification, which imposes a specific language/locale assumption in natural-language behavior. The file does not indicate that users can configure or opt into these language mappings.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.