ClawHub
Back to skill

Security audit

Obsidian Memory System Clawhub Reviewfix

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a paid local Obsidian memory helper, but it asks for broad local file access and uses a remote payment credential flow with inconsistent disclosure.

Review this before installing if you are comfortable granting local Obsidian read/write access and letting the payment flow send a local payment credential to https://api.ideaidea.com.cn. Configure a narrow Obsidian vault/path, avoid using it on sensitive vaults until scoping is clearer, and delete local order files when no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill markets itself primarily as a local Obsidian memory system, but the documented operational steps in this file focus on paid order creation, third-party verification, credential-linked local order files, and a remote service dependency. That mismatch is dangerous because users may grant sensitive filesystem, credential, and network permissions expecting local note management, while the actual exposed behavior centers on commerce/authorization flows and opaque external dependencies rather than the advertised memory functionality.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The code sends a locally stored payment credential to a third-party HTTPS endpoint, which directly contradicts the skill's stated claim that only slug and order metadata are transmitted. This creates a sensitive-data disclosure issue because users and downstream reviewers may rely on the manifest description when deciding whether the skill is safe to install or run.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The CLI presents the action as payment verification and authorization retrieval, but the actual flow pulls a payCredential from local storage and sends it to a remote server. That mismatch is security-relevant because it conceals network transmission of a sensitive value from the operator, undermining informed consent and auditability.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
A payment credential is sent to a remote service with no explicit user-facing warning in this file, despite the surrounding skill context claiming that only limited order metadata leaves the machine. In a skill marketed around local-only handling of user data, undisclosed transmission of credentials materially increases trust and privacy risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.