Backup of conversations to Obsidian

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:38 AM UTC
• Version: 1.0.0

Overview

This is a real Obsidian backup skill, but it needs review because it can archive full chats and use local Telegram credentials to send external token alerts.

Install only if you are comfortable with your Clawdbot conversations being copied into an Obsidian vault. Keep that vault private or encrypted if chats may contain secrets. Review or disable the Telegram section in scripts/monitor_and_save.sh unless you explicitly want the skill to read your Clawdbot Telegram token and send token-threshold alerts to Telegram.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents shell-based installation, cron setup, and script execution, but does not declare the permissions or execution capabilities it requires. That creates a transparency and consent problem: users may invoke a skill that performs filesystem writes and scheduled background execution without an explicit capability declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The stated purpose is conversation backup for Obsidian, but the documented behavior also includes token monitoring and outbound Telegram notifications using local credentials. Hidden or weakly disclosed secondary behavior increases the risk of unauthorized data handling and external communications beyond user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: Claiming 'Zero token cost' and presenting the skill primarily as a backup tool is misleading when it also performs monitoring and notification functions. Misleading documentation can cause users to underestimate operational scope, privacy implications, and network activity.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as a local Obsidian backup utility, but it also performs outbound Telegram notifications using credentials loaded from a local config file. Even though the transmitted data is limited to token/count metadata, this is still undisclosed external communication and expands the trust boundary beyond local archival behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The backup script includes Telegram alerting functionality that is not necessary for writing local Obsidian snapshots. This creates an unexpected egress path and may leak usage metadata such as context size and activity timing to a third-party service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README promotes automatic hourly conversation backups but does not clearly warn that potentially sensitive conversation contents will be persisted to an Obsidian vault on disk. In the context of a conversation archival skill, silent or underexplained local data persistence increases the risk of users unintentionally storing secrets, personal data, or regulated information in a searchable note repository.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill automatically archives conversation content into an Obsidian vault and is intended for scheduled execution, but it does not prominently warn users about the privacy and retention implications. Conversation transcripts can contain sensitive secrets, credentials, or personal data, making silent persistence risky.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Telegram notifications are mentioned without a clear warning that data will be transmitted to an external service using bot credentials. Even if only token-usage metadata is sent, outbound messaging introduces privacy, credential-management, and unintended disclosure risks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script unconditionally writes conversation-derived content into predictable files inside an Obsidian vault using shell redirection, which can overwrite existing notes for the same date/hour without prompting or preserving prior content. Because the data being copied is chat/session content, this also creates an implicit confidentiality and retention risk by silently duplicating potentially sensitive conversations into another location.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This script automatically converts session JSONL data into readable markdown transcripts and writes them into an Obsidian vault without any in-script warning, consent gate, or retention control. Because conversations can contain secrets, personal data, or sensitive prompts, silent persistence materially increases exposure if the vault is synced, shared, or later accessed by others.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script sends session-related metadata to Telegram without any user-facing disclosure in the script itself. Although the message body does not include transcript contents, it still leaks operational details such as token volume and active usage thresholds to an external service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script unconditionally writes the full contents of the latest session file to a markdown file in the Obsidian vault, which can persist sensitive conversation data such as secrets, personal information, or internal prompts without any consent check, redaction, or access-control safeguard. In this skill’s context, the entire purpose is archival of conversations, so the risky behavior is intentional functionality rather than malicious logic, but it still increases exposure if the vault is synced, shared, or less protected than the original session store.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Send urgent warning via Telegram
        BOT_TOKEN=$(jq -r '.telegram.token' /root/.clawdbot/clawdbot.json 2>/dev/null)
        if [[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]]; then
            curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
                -d "chat_id=${CHAT_ID}" \
                -d "text=🚨 URGENT: Context at ${TOKENS}k/1M (90%+) - Run /new NOW" > /dev/null
        fi

• Confidence: 90% confidence
• Finding: curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${CHAT_ID}" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

if [[ ! -f "$WARNING_SENT_FILE" ]] || [[ $(cat "$WARNING_SENT_FILE") != "800k" ]]; then
        BOT_TOKEN=$(jq -r '.telegram.token' /root/.clawdbot/clawdbot.json 2>/dev/null)
        if [[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]]; then
            curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
                -d "chat_id=${CHAT_ID}" \
                -d "text=⚠️ TOKEN WARNING: Context at ${TOKENS}k/1M (80%+) - Consider /new soon" > /dev/null
        fi

• Confidence: 90% confidence
• Finding: curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${CHAT_ID}" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

# Send urgent warning via Telegram
        BOT_TOKEN=$(jq -r '.telegram.token' /root/.clawdbot/clawdbot.json 2>/dev/null)
        if [[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]]; then
            curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
                -d "chat_id=${CHAT_ID}" \
                -d "text=🚨 URGENT: Context at ${TOKENS}k/1M (90%+) - Run /new NOW" > /dev/null
        fi

• Confidence: 90% confidence
• Finding: https://api.telegram.org/

External Transmission

Medium

• Category: Data Exfiltration

Content

if [[ ! -f "$WARNING_SENT_FILE" ]] || [[ $(cat "$WARNING_SENT_FILE") != "800k" ]]; then
        BOT_TOKEN=$(jq -r '.telegram.token' /root/.clawdbot/clawdbot.json 2>/dev/null)
        if [[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]]; then
            curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
                -d "chat_id=${CHAT_ID}" \
                -d "text=⚠️ TOKEN WARNING: Context at ${TOKENS}k/1M (80%+) - Consider /new soon" > /dev/null
        fi

• Confidence: 90% confidence
• Finding: https://api.telegram.org/

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.