ClawHub
Back to skill

Security audit

obsidian-rest-api

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Obsidian integration, but it gives an agent a reusable key that can read and change your vault.

Install only if you are comfortable giving the agent access to read and modify your Obsidian vault. Keep the API key private, restrict the REST API/firewall exposure to trusted hosts, and explicitly review any write, delete, or command-execution request before allowing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill exposes command execution through the Obsidian REST API, which goes beyond the narrower note read/write/search scope described in the manifest. Even if limited to Obsidian commands, this materially expands the action surface and can trigger unintended state changes, plugins, or automation inside the user's vault environment.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The instructions tell the agent to persist the API key in plaintext in TOOLS.md, which risks credential disclosure through local file reads, logs, backups, screenshots, or later agent access. Because this key authorizes remote modification of the Obsidian vault, exposure can directly enable unauthorized access and data tampering.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
Documenting a generic command-execution endpoint without restrictions or warnings is more security-relevant than ordinary file CRUD because it can trigger arbitrary application actions with side effects beyond a single note. In an agent skill, this increases the chance that untrusted user input could be mapped directly into command IDs and cause unintended state changes in the local Obsidian app.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.