ClawHub
Back to skill

Security audit

Korta Obsidian

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal Obsidian note-management skill, but users should be careful with its documented delete command.

Install only if you intend the agent to manage notes in your Obsidian vault. Before using delete commands, verify the active vault and exact note path, and prefer archiving or backups when possible.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill documents a permanent delete operation (`obsidian-cli delete "path/note"`) without any warning about irreversibility, confirmation, backups, or safe alternatives. In a note-management skill, users may copy commands directly, so omission of caution materially increases the chance of accidental data loss in the active vault.

Static analysis

No suspicious patterns detected.