obsidian-memory-system

• Outcome: Pass
• Latest audit: Jul 28, 2026 · 3:10 PM UTC
• Version: 3.0.40

Overview

This skill is a local clawtip payment-gated Obsidian memory service with some incomplete storage disclosure, but no evidence of hidden exfiltration or destructive behavior.

Before installing, understand that creating an order will save your question and payment/order metadata in a local JSON file under your home directory. Do not put secrets, private vault contents, or highly sensitive project details in the payment question unless you are comfortable with local persistence and backups retaining it.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file header claims the stored order contains only a narrow set of fields, but the implementation also persists plaintext payTo, description, and resource_url. Misleading data-handling claims are security-relevant because users and downstream agents may trust the script with sensitive prompts under false assumptions about what is written to disk.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The console notice states the saved file contains only orderNo, amount, and question, but the JSON written to disk includes additional metadata such as payTo, encrypted_data, description, resource_url, and slug. This is a transparency and trust issue that can lead users or calling agents to disclose data they would not have provided if the storage behavior were accurately described.

Session Persistence

Medium

• Category: Rogue Agent

Content

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Create obsidian-memory-system order for clawtip payment"
    )
    parser.add_argument("question", help="User question / consultation content")
    args = parser.parse_args()

• Confidence: 80% confidence
• Finding: The script accepts arbitrary user question content and persists it under the user's home directory as a JSON order file, creating durable local storage of potentially sensitive consultation text. In the context of a memory-oriented skill, persistent storage is expected, but saving free-form prompts can still expose personal, project, or confidential information to other local users, backups, or later processes.

Static analysis

No suspicious patterns detected.