ClawHub
Back to skill

Security audit

Obsidian WSL

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Obsidian vault helper, with the main caution being its unpinned third-party Homebrew dependency.

Install only if you trust the notesmd-cli Homebrew tap and are comfortable giving the CLI access to the Obsidian vaults configured for your user account. Be careful with overwrite, move, frontmatter delete, and note delete commands because they can change or remove vault content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Third-Party Homebrew Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–16
Vulnerability Type: Unpinned third-party dependency and mutable supply-chain source
Risk Level: Medium

Vulnerable Code

yaml
"requires": { "bins": ["notesmd-cli"] },
"install":
  [
    {
      "id": "brew",
      "kind": "brew",
      "formula": "yakitrak/yakitrak/notesmd-cli",
      "bins": ["notesmd-cli"],
      "label": "安装 notesmd-cli (brew)",
    },
  ],

Technical Analysis

The Skill declares notesmd-cli as a required binary and recommends installing it from the third-party Homebrew tap yakitrak/yakitrak. The dependency declaration does not pin an audited version, immutable source commit, package digest, or checksum.

Consequently, the dependency resolved during installation may differ from the version present when the Skill was reviewed. If the third-party tap, formula, upstream release process, or maintainer account is compromised, an attacker could distribute modified installation logic or a malicious executable under the expected package name.

This finding concerns dependency provenance and mutability. The audited Skill itself does not contain an encoded payload, remote script execution command, or embedded malicious script.

Attack Path

  1. An attacker compromises the third-party Homebrew tap, its maintainer account, the referenced upstream release, or another component of its distribution chain.
  2. The attacker modifies the mutable formula or package artifact to install a malicious notesmd-cli executable or execute malicious installation logic.
  3. A user or automation framework installs the dependency using the Skill's declared Homebrew formula.
  4. Homebrew retrieves and processes the compromised formula or artifact.
  5. The malicious code executes with the permissions of the account performing installation or invoking notesmd-cli.
  6. Because the documented workflow uses the binary to access Obsidian vaults, the compromised tool can potentially rea ...[truncated 564 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer an official, verified distribution source under the dependency publisher's control.
  2. Pin the dependency to a specifically audited version or immutable source commit rather than relying on a mutable formula reference.
  3. Verify downloaded artifacts using a cryptographic checksum or signature anchored in a trusted release process.
  4. Record the expected package source, version, checksum, and publisher identity in the Skill metadata or installation documentation.
  5. Review the Homebrew formula and its transitive download sources before approving updates.
  6. Perform dependency updates through a controlled review process and rerun security testing whenever the pinned version or checksum changes.
  7. Where supported, execute the tool with only the filesystem permissions required for the intended Obsidian vault.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.