Security checks for vulnerabilities and agentic risk
Overview
This is a small documentation-only skill for using an Obsidian CLI, with expected note access but some installation and privacy cautions users should review.
Install only if you trust the `cli-obsidian` package source, preferably in a virtual environment and without admin privileges. Point it only at Obsidian vaults you intend the agent to access or modify, and consider backups before allowing automated note management or export.
File Location: SKILL.md:14-18; duplicated in README.md:21-25 Vulnerability Type: Unpinned third-party dependency installed from a mutable public package repository Risk Level: Medium
### Technical Analysis
Both installation instructions direct users or AI agents to install `cli-obsidian` from the default Python Package Index without specifying an exact version, package hash, or trusted artifact source. Consequently, the code installed is determined at installation time rather than being fixed to the version reviewed with this skill.
If the package owner account, publishing credentials, package namespace, or upstream release process is compromised, an attacker can publish a malicious newer release. Subsequent execution of the documented command would select that release. Python packages may execute build or installation logic, and their installed command-line entry points execute when users invoke `cli-obsidian`.
The repository contains only documentation and metadata; it does not include source code, a lock file, hashes, signatures, or other material through which the installed package can be independently audited or verified.
### Attack Path
1. An attacker compromises the upstream package publisher, release pipeline, or associated PyPI credentials.
2. The attacker publishes a malicious version of `cli-obsidian`.
3. A user or AI agent follows the project documentation and runs `pip install cli-obsidian`.
4. Pip resolves the mutable package name to the attacker-controlled release because no version or hash is constrained.
5. Malicious package installation logic or the installed CLI entry point executes with the installing user's privileges.
6. The payload can access resour
...[truncated 916 chars]
Remediation
View remediation
Remediation Suggestions
Pin the dependency to a reviewed exact version, for example:
bash
python -m pip install "cli-obsidian==1.0.0"
Publish and document SHA-256 hashes for approved distribution artifacts, and use a hash-locked requirements file:
text
This markdown file promotes direct AI-agent operation of notes, including automatic meeting-note recording, batch management, and data export, but does not include any caution about modifying user notes, exporting data, or privacy implications. For markdown files, user-facing documentation should warn when behavior may affect user data or system integrity.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
92% confidence
Finding
The README presents the skill entirely in Chinese and does not indicate that the language is optional, configurable, or justified by a region-specific scope. This can constitute a natural-language policy issue when a specific language is effectively imposed without user opt-in.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
84% confidence
Finding
The README states that the tool lets an AI agent directly operate notes and shows note-creation commands, but it does not include any user warning about modifying user data or note contents. For a markdown skill description, actions affecting user data should be disclosed so users understand the integrity and overwrite risks before use.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
91% confidence
Finding
The primary descriptive heading is written in Chinese and presents the skill in that language without any indication of language choice or opt-in. This can violate language/locale policy where skills should not impose a specific language on users absent documentation or explicit selection.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
86% confidence
Finding
The display name and description are written only in Chinese, which can reflect a language-specific presentation without any stated opt-in or documented locale scope. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific.
