ClawHub
Back to skill

Security audit

Backup of conversations to Obsidian

Security checks for vulnerabilities and agentic risk

Overview

This backup skill mostly does what it says, but it handles sensitive chat history, recommends scheduled background execution, can send Telegram alerts, and has an installer flaw that could turn pasted paths into recurring shell execution.

Review before installing. Only run this under a low-privilege account, inspect install.sh first, avoid pasting paths you do not fully trust, and do not enable cron until the scripts are configured safely. Treat the Obsidian vault as sensitive because it will contain conversation transcripts. Disable or remove Telegram alerting unless you intentionally want token-status metadata sent through Telegram, and check for any existing CHAT_ID or Clawdbot Telegram configuration before running the monitor script.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
install.sh:8
Finding

Unsanitized installation paths enable persistent shell command injection

Content
View full analysis
Remediation
View remediation
config ``` 3. **Validate path input.** Reject control characters and newlines, require absolute paths where appropriate, and enforce an explicit policy for allowed characters and locations. 4. **If `sed` remains necessary, escape values separately for the replacement context.** At minimum, escape backslashes, ampersands, and the selected delimiter. This is less robust than separating code from configuration and does not replace shell-safe serialization. 5. **Validate generated scripts before use.** Run `bash -n` on every generated or modified shell script and abort installation if validation fails. 6. **Apply least privilege.** Recommend installation and cron execution under a dedicated unprivileged account with read-only access to the required session directory and write access only to the selected vault and tracking directories. Replace root-oriented defaults with user-scoped paths. 7. **Harden scheduled execution.** Use absolute paths, a restricted `PATH`, restrictive file permissions, and verify that the script and configuration are owned by the scheduling user and are not writable by other accounts. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose focuses on Obsidian conversation backup, but the content also describes token monitoring and outbound Telegram notifications using separate credentials. That behavioral mismatch is dangerous because reviewers may approve it for local archival while overlooking network egress and monitoring functionality.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

  • Delete tracking files and let system reset:
    bash
    rm /root/clawd/.last_snapshot_timestamp

Empty callout boxes appearing

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

./install.sh

Add to crontab for automatic hourly backups

crontab -e

Add: 0 * * * * /path/to/scripts/monitor_and_save.sh

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 56)May include surrounding context.

sh
./install.sh

# Add to crontab for automatic hourly backups
crontab -e
# Add: 0 * * * * /path/to/scripts/monitor_and_save.sh
```

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents shell-script installation, chmod, cron setup, and direct command execution, but it does not declare any explicit tool scope or allowed tools. This weakens reviewability and consent because users and platforms are not clearly warned that the skill requires shell access and persistence-related setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is explicitly designed to copy conversation contents into an Obsidian vault and configure recurring backups, but the documentation does not prominently warn that potentially sensitive chats will be persisted to disk on an ongoing schedule. This can lead to accidental retention of secrets, personal data, or regulated content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill instructs the user to install a cron job that runs automatically every hour, which establishes persistence on the host. While persistence is expected for backup automation, it still carries security risk because compromised or modified scripts would execute repeatedly without further user interaction.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Add to crontab for hourly backups:

bash
crontab -e

# Add this line (runs every hour at :00)
0 * * * * /path/to/obsidian-conversation-backup/scripts/monitor_and_save.sh

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Telegram alerting introduces functionality beyond straightforward local backup, creating external communication paths and handling of notification credentials. Even if only token-usage thresholds are sent, this expands attack surface and may leak operational metadata to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The Telegram notification section describes warnings being sent externally but does not clearly disclose that system-state or usage metadata is transmitted to a third-party messaging service. Users may not realize that enabling this feature creates network egress and exposes operational information outside the local machine.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md
### No snapshots being created

1. Check cron is running: `crontab -l`
2. Verify script has execute permission: `chmod +x scripts/*.sh`
3. Check logs: Run manually to see errors

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script automatically converts and writes conversation content into markdown files in an Obsidian vault without any user-facing confirmation in this code path. Because conversations may contain sensitive prompts, secrets, or personal data, silent persistence increases confidentiality and retention risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script is presented as an Obsidian backup utility, but it also sends Telegram notifications and reads bot credentials. That hidden scope expansion creates an unexpected external data flow and increases trust risk, especially because users may not anticipate any network activity from a local archival tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends context-usage status to Telegram without any user-facing notice in the script itself. Even if message contents are minimal, this is still an external disclosure of operational metadata and confirms use of the system to a third party.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code reads a Telegram bot token from a local config and performs external network calls unrelated to the core local backup/archive function. Even though the transmitted message is limited to context status, accessing credentials and initiating outbound traffic creates unnecessary exposure and could violate user expectations or policy boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The hardcoded Telegram API endpoint confirms that this script communicates with an external service. In the context of a backup skill, undisclosed remote communication is security-relevant because it changes the trust model from local-only processing to third-party data exchange.

Content

Scanner excerpt · scripts/monitor_and_save.sh (reported line 119)May include surrounding context.

sh
# Send urgent warning via Telegram
        BOT_TOKEN=$(jq -r '.telegram.token' /root/.clawdbot/clawdbot.json 2>/dev/null)
        if [[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]]; then
            curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
                -d "chat_id=${CHAT_ID}" \
                -d "text=🚨 URGENT: Context at ${TOKENS}k/1M (90%+) - Run /new NOW" > /dev/null
        fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The hardcoded Telegram API endpoint confirms that this script communicates with an external service. In the context of a backup skill, undisclosed remote communication is security-relevant because it changes the trust model from local-only processing to third-party data exchange.

Content

Scanner excerpt · scripts/monitor_and_save.sh (reported line 119)May include surrounding context.

sh
# Send urgent warning via Telegram
        BOT_TOKEN=$(jq -r '.telegram.token' /root/.clawdbot/clawdbot.json 2>/dev/null)
        if [[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]]; then
            curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
                -d "chat_id=${CHAT_ID}" \
                -d "text=🚨 URGENT: Context at ${TOKENS}k/1M (90%+) - Run /new NOW" > /dev/null
        fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This endpoint usage is another instance of external transmission to Telegram for threshold notifications. Although the payload is not the full transcript, the mere fact of remote status reporting can expose usage patterns and violate assumptions about a self-contained backup tool.

Content

Scanner excerpt · scripts/monitor_and_save.sh (reported line 129)May include surrounding context.

sh
if [[ ! -f "$WARNING_SENT_FILE" ]] || [[ $(cat "$WARNING_SENT_FILE") != "800k" ]]; then
        BOT_TOKEN=$(jq -r '.telegram.token' /root/.clawdbot/clawdbot.json 2>/dev/null)
        if [[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]]; then
            curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
                -d "chat_id=${CHAT_ID}" \
                -d "text=⚠️ TOKEN WARNING: Context at ${TOKENS}k/1M (80%+) - Consider /new soon" > /dev/null
        fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This endpoint usage is another instance of external transmission to Telegram for threshold notifications. Although the payload is not the full transcript, the mere fact of remote status reporting can expose usage patterns and violate assumptions about a self-contained backup tool.

Content

Scanner excerpt · scripts/monitor_and_save.sh (reported line 129)May include surrounding context.

sh
if [[ ! -f "$WARNING_SENT_FILE" ]] || [[ $(cat "$WARNING_SENT_FILE") != "800k" ]]; then
        BOT_TOKEN=$(jq -r '.telegram.token' /root/.clawdbot/clawdbot.json 2>/dev/null)
        if [[ -n "$BOT_TOKEN" && -n "$CHAT_ID" ]]; then
            curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
                -d "chat_id=${CHAT_ID}" \
                -d "text=⚠️ TOKEN WARNING: Context at ${TOKENS}k/1M (80%+) - Consider /new soon" > /dev/null
        fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script automatically reads the most recent session file from a hidden application directory containing conversation records, which may hold sensitive user data. Accessing and exporting these records without any disclosure, scoping checks, or user review increases the chance of unintended data collection and propagation beyond the original application context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script persists the entire conversation history to a markdown file in an Obsidian vault, which can include secrets, personal data, or proprietary content from the session. Even though this appears to be the skill’s intended functionality, writing full transcripts to disk without consent prompts, redaction, retention controls, or access warnings creates a real confidentiality risk if the vault is synced, shared, or improperly protected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The README presents the skill as entirely local and shell-based, but the markdown includes an externally hosted image URL. While this is documentation rather than runtime code, it still introduces network access not implied by the local-backup framing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The formatter emits a fixed natural-language label, "🦞 Zoidbot," for assistant messages. This is a natural-language policy concern because it forces a specific presentation identity rather than preserving a neutral label or offering a configurable choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.