ClawHub
Back to skill

Security audit

obsidian-memory-system

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed payment-gated conversation service that stores local order records, with no evidence of hidden network transfer or Obsidian vault access.

Install only if you are comfortable with a paid, chat-delivered memory-management service. Do not include secrets, passwords, API keys, or private note contents in the question because it is saved locally in the order file and echoed to output.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The skill markets itself as an Obsidian persistent memory system that does not collect or transmit vault content, but the documented behavior primarily creates payment orders, stores user-supplied question text locally, and validates payment before instructing the AI to deliver a service in chat. This mismatch is dangerous because it can mislead users about what the skill actually does, what data is retained locally, and the fact that the promised memory functionality is not implemented in code but delegated to unconstrained conversational behavior.

Session Persistence

Medium
Category
Rogue Agent
Content
if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Create obsidian-memory-system order for clawtip payment"
    )
    parser.add_argument("question", help="User question / consultation content")
    args = parser.parse_args()
Confidence
96% confidence
Finding
The script persists user-supplied question content to a local JSON file under the user's home directory, and also echoes the question to stdout. Because the prompt text may contain secrets, internal project details, or sensitive operational context, this creates an unintended local data-retention channel that can expose information to other local users, backup systems, logs, or later processes.

Static analysis

No suspicious patterns detected.