Korta Obsidian

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:25 AM UTC
• Version: 1.0.0

Overview

This is a coherent Obsidian helper skill, but users should be careful because it can install a third-party CLI and delete notes when directed.

Install only if you trust the obsidian-cli Homebrew tap. Before allowing deletion or moves, confirm the active vault and exact note path, and keep backups or Obsidian sync/version history enabled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned dependency from a third-party Homebrew tap
Risk Level: Medium

Affected code:

yaml

metadata: {"clawdbot":{"emoji":"💎","requires":{"bins":["obsidian-cli"]},"install":[{"id":"brew","kind":"brew","formula":"yakitrak/yakitrak/obsidian-cli","bins":["obsidian-cli"],"label":"Install obsidian-cli (brew)"}]}}

Technical Analysis

The skill directs the environment to install obsidian-cli from the third-party Homebrew tap yakitrak/yakitrak. The dependency declaration does not pin a reviewed version, immutable source revision, package digest, or binary checksum. Consequently, the code installed when the skill is used may differ from the code that was available when the skill was audited.

This creates a supply-chain trust boundary: control of the tap, formula, referenced release artifact, or associated maintainer account could allow an attacker to substitute malicious installation logic or an altered executable. There is no evidence in the reviewed files that the current dependency is malicious; the vulnerability is the absence of controls that ensure the installed component remains identical to a reviewed artifact.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, or an artifact location referenced by its formula.
2. The attacker changes the formula or release artifact to install an attacker-controlled obsidian-cli executable.
3. A user loads the skill in an environment where the required binary is absent and follows or triggers the declared Homebrew installation.
4. Homebrew retrieves and installs the altered dependency without this skill independently validating an immutable version and checksum.
5. The malicious executable runs when the documented obsidian-cli commands are invoked.
6. Because the CLI is intended to locate and manipulate Obsidian vaults, the substitut ...[truncated 917 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific reviewed release rather than accepting the current state of a mutable third-party tap.
2. Require an immutable SHA-256 checksum for the downloaded artifact and fail installation if verification does not succeed.
3. Prefer an official, authenticated distribution channel maintained by the Obsidian project when one is available.
4. If the third-party tap must be used, pin its repository to a reviewed commit and audit both the formula and every script or artifact it downloads.
5. Record the expected upstream repository, version, artifact URL, checksum, and maintainer identity in the skill documentation.
6. Run the CLI with ordinary user privileges and restrict its filesystem and network access to the minimum required for the selected vault.
7. Require explicit user confirmation before installation and before destructive operations such as note deletion.
8. Periodically re-audit the pinned dependency before upgrading it, rather than allowing automatic adoption of unreviewed releases.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documents a destructive obsidian-cli delete "path/note" operation with no warning about permanence, scope validation, or confirmation practices. In an agentic context, this increases the chance that an LLM or automation will delete user notes based on ambiguous instructions, incorrect path resolution, or the wrong selected vault.

Content

No source excerpt is available for this finding.