Security audit

Obsidian Tasks

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Obsidian task-board purpose, but its setup script can write outside the chosen vault if given an absolute or traversal folder path.

Review before installing. Use this only on a test or backed-up Obsidian vault, pass a simple relative folder name such as Tasks, and avoid absolute paths or ../ in --folder. Prefer pinned ClawHub CLI versions for install, login, and publish workflows where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.py:89
Finding: Unsanitized Folder Path Allows Writes Outside the Selected Vault
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/publish_clawhub.sh:7
Finding: Mutable npm Package Version Is Downloaded and Executed
Content: View full analysis
[changelog]"} CHANGELOG=${2:-"Update"} REPO_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd) SITE_URL=${CLAWHUB_SITE:-"https://clawhub.ai"} REGISTRY_URL=${CLAWHUB_REGISTRY:-"https://auth.clawdhub.com"} TAGS=${CLAWHUB_TAGS:-"latest,obsidian,kanban,dataview,tasks,productivity"} npx -y clawhub@latest \ --site "$SITE_URL" \ --registry "$REGISTRY_URL" \ publish "$REPO_DIR" \ --slug openclaw-obsidian-tasks \ --name "Obsidian Tasks" \ --version "$VERSION" \ --tags "$TAGS" \ --changelog "$CHANGELOG" ``` The README also instructs users and maintainers to execute the mutable package reference: ```bash npx clawhub@latest install openclaw-obsidian-tasks ``` ```bash npx -y clawhub@latest login ``` ### Technical Analysis The commands use `clawhub@latest`, which is a mutable npm distribution tag rather than an immutable, reviewed package version. `npx` can download the package from a remote npm registry and execute its entry point locally. The `-y` option suppresses the normal installation confirmation in the login and publishing workflows. Consequently, the code executed by these commands can change after this repository has been audited without any corresponding modification to the repository. This creates a supply-chain trust dependency on the package publisher, npm account security, registry integrity, DNS and network configuration, and the current package associated with the `latest` tag. No evidence in the audited project establishes that the current Claw ...[truncated 1378 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A description-behavior mismatch where the declared purpose is local Obsidian task management but the underlying capability reportedly publishes packages to an external service and invokes networked tooling is a strong trust-boundary violation. This is dangerous because users may consent to local note setup while the skill performs unrelated external actions, potentially exfiltrating data or publishing artifacts without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A description-behavior mismatch where the declared purpose is local Obsidian task management but the underlying capability reportedly publishes packages to an external service and invokes networked tooling is a strong trust-boundary violation. This is dangerous because users may consent to local note setup while the skill performs unrelated external actions, potentially exfiltrating data or publishing artifacts without informed consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to run npx clawhub@latest install ..., which fetches and executes remote package code at install time without pinning to a specific reviewed version. If the upstream package, dependency chain, or publishing account were compromised, users could execute unintended code on their systems. In the context of an agent skill install path, this is more dangerous because users may copy/paste commands with elevated trust.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The publish/login instructions use npx -y clawhub@latest login, which similarly executes the newest remote package version without review or pinning. This creates a supply-chain execution risk for maintainers, and the maintainer context can be especially sensitive because login flows may expose credentials or tokens if a malicious package version is served.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes filesystem-modifying behavior such as running a setup script that creates files in a user-provided vault path, but it declares no explicit tool scope or permissions boundary. This is dangerous because an agent may perform writes without clear user-visible authorization constraints, increasing the risk of unintended file modification in arbitrary directories.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The script executes npx -y clawhub@latest, which fetches and runs the newest package version at publish time. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, running the script will execute attacker-controlled code on the operator's machine or CI environment with the user's permissions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a local Obsidian task-board setup and management skill, but this script runs npx -y clawhub@latest to fetch and execute a remote publishing tool and publish the repository to ClawHub. Repository publication to an external service is not justified by the end-user task-tracking purpose described in the manifest.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README tells users to run a setup script against an Obsidian vault path and explains that it sets up boards and task files, but it does not clearly warn that local vault contents will be created or modified. While this is expected behavior for the skill, the lack of an explicit modification warning can lead to unintended changes, especially if an agent is asked to act on the user's vault automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs creation of files in a user-supplied vault path without warning that the user's Obsidian vault will be modified. While expected in a setup utility, this is still risky because an incorrect or attacker-influenced path could cause unintended writes to sensitive directories or existing notes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.