Back to skill
Skillv1.0.0
ClawScan security
Korta Obsidian · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 8, 2026, 6:21 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions align with its stated purpose (automating Obsidian via obsidian-cli); it reads local Obsidian config and runs file operations, and the main residual risk is installing a third‑party brew formula and letting an autonomous agent perform destructive file operations.
- Guidance
- This skill appears to do what it says: it finds Obsidian vaults (by reading the local obsidian.json) and runs obsidian-cli to search, create, move, or delete notes. Before installing: 1) Confirm you are comfortable with obsidian-cli having filesystem access to your vaults — create/move/delete are destructive, so back up your vault first. 2) Verify the Homebrew tap (yakitrak/yakitrak) and the obsidian-cli formula are trustworthy (review the tap repo or install from an official source if available). 3) Note the SKILL.md assumes a macOS config path; behavior on Linux/Windows may differ. 4) If you plan to allow the agent to invoke this skill autonomously, limit scope or require explicit confirmation for destructive commands so the agent cannot inadvertently alter or delete notes.
Review Dimensions
- Purpose & Capability
- okName/description match the runtime instructions: the skill uses obsidian-cli to inspect and modify Obsidian vaults. Required binary (obsidian-cli) and the brew install are consistent with the stated purpose. Minor metadata mismatch: ownerId in _meta.json differs from registry metadata entry, which looks like bookkeeping noise but not functionality-related.
- Instruction Scope
- okSKILL.md instructs the agent to read Obsidian's config (~/Library/Application Support/obsidian/obsidian.json) to discover vaults and to run obsidian-cli commands (search, create, move, delete). These actions are within scope for a tool that automates local vaults. Note: reading the config and running create/move/delete will access and modify local files (notes and attachments), which is expected but potentially destructive.
- Install Mechanism
- noteInstall spec uses Homebrew, which is normal, but the formula is from a third‑party tap (yakitrak/yakitrak). This is not an official Obsidian distribution; verify the tap and formula trustworthiness before installing. The installer will create an obsidian-cli binary on disk.
- Credentials
- okThe skill requests no environment variables or credentials. It does read a local Obsidian config file and will operate on files inside vault folders — appropriate for the stated purpose but worth noting that notes may contain sensitive content.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system-wide privileges. It does install a binary into the system via brew (per install spec), but it does not modify other skills or agent-wide settings per the provided files.