ClawHub
Back to skill

Security audit

Obsidian GitHub Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can set up unattended jobs that automatically commit and push an entire Obsidian vault to GitHub.

Review this carefully before installing. Use it only with a repository you have verified, preferably private, and inspect .gitignore and git status before the first push. Avoid enabling cron or systemd automation until you are comfortable with unattended commits and uploads, and keep removal commands handy.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Error
Location
references/setup-guide.md:45
Finding

Persistent Unattended Vault Synchronization Through Scheduled Tasks

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:34-42
  • SKILL.md:125-168
  • references/setup-guide.md:45-66

Vulnerability Type: Scheduled task and user-service persistence
Risk Level: High

Vulnerable Code

references/setup-guide.md:45-66:

bash
### 使用 Cron (Linux/Mac)

```bash
# 编辑 crontab
crontab -e

# 每天凌晨3点同步
0 3 * * * /path/to/obsidian-github-sync/scripts/obsidian-sync.sh

# 每天早上9点检查冲突
0 9 * * * /path/to/obsidian-github-sync/scripts/check-conflict.sh

使用 OpenClaw Cron

bash
openclaw cron add --name "obsidian-sync" \
  --cron "0 3 * * *" \
  --command "/path/to/obsidian-github-sync/scripts/obsidian-sync.sh"

openclaw cron add --name "obsidian-check" \
  --cron "0 9 * * *" \
  --command "/path/to/obsidian-github-sync/scripts/check-conflict.sh"
text

`SKILL.md:125-168`:

```bash
### With OpenClaw

```bash
# Add sync cron job
openclaw cron add --name "obsidian-sync" \
  --cron "0 3 * * *" \
  --command "/path/to/obsidian-sync.sh"

# Add conflict check
openclaw cron add --name "obsidian-check" \
  --cron "0 9 * * *" \
  --command "/path/to/check-conflict.sh"

With Systemd (Linux)

Create ~/.config/systemd/user/obsidian-sync.service:

ini
[Unit]
Description=Obsidian Vault Git Sync

[Service]
Type=oneshot
Environment="OBSIDIAN_VAULT_DIR=/path/to/vault"
Environment="GITHUB_REMOTE_URL=git@github.com:user/repo.git"
ExecStart=/path/to/obsidian-sync.sh

Create ~/.config/systemd/user/obsidian-sync.timer:

ini
[Unit]
Description=Run Obsidian sync daily at 3 AM

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target

Enable:

bash
systemctl --user daemon-reload
systemctl --user enable obsidian-sync.timer
systemctl --user start obsidian-sync.timer
text

### Technical Analysis

The Skill instructs users to register recurring cron or
...[truncated 3112 chars]
Remediation
View remediation

Remediation Suggestions

  1. Keep manual synchronization as the default and make scheduled execution explicitly opt-in.
  2. Before installation, clearly disclose that the job survives the current session, runs without per-run approval, and may upload all unignored vault content.
  3. Require users to verify the repository URL, repository visibility, selected branch, .gitignore, and staged files before enabling automatic pushes.
  4. Provide removal commands alongside installation instructions:
    • Remove the relevant entries with crontab -e.
    • Remove OpenClaw jobs using the applicable OpenClaw deletion command.
    • Disable and remove the systemd timer and service files.
  5. Place scheduled scripts in a user-owned directory that is not writable by other users, and use canonical absolute paths.
  6. Restrict permissions on the script, service, timer, log, and conflict-marker files.
  7. Add integrity validation or deploy a protected immutable copy of the script before scheduling it.
  8. Consider separating commit creation from network upload so unattended operation does not push sensitive content without review.
  9. Add a dry-run or staging review mode and exclude sensitive Obsidian files through a secure default .gitignore.
  10. Avoid Persistent=true unless catch-up execution is specifically requested and its behavior is clearly explained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 27)May include surrounding context.

bash
ssh-keygen -t ed25519 -C "your@email.com"
cat ~/.ssh/id_ed25519.pub
# 将公钥添加到 GitHub Settings -> SSH and GPG keys

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases include broad, common language such as 'vault backup' and 'sync my notes', which can cause the skill to activate in contexts where the user did not specifically request GitHub-based Obsidian synchronization. Unintended invocation is risky here because the skill describes automation that can commit, pull, and push note data, potentially causing unwanted repository changes or exposure of sensitive notes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises automatic sync behavior but does not prominently warn users that it may auto-commit local changes and push note contents to a remote GitHub repository. In this context, that omission can lead users to expose sensitive personal notes, overwrite expected history, or create persistent automation without fully understanding the consequences.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
↓
pull --rebase fails (remote has divergent changes)
    ↓
Create conflict flag file
    ↓
Exit with error
    ↓

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The documented use of 'systemctl --user enable' establishes persistent scheduled execution of the sync task across sessions. Persistence is expected for automation, but in a skill context it increases risk because a one-time setup can continue committing and pushing note data without repeated user review, especially if the repository or vault path is misconfigured.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

Enable:

bash
systemctl --user daemon-reload
systemctl --user enable obsidian-sync.timer
systemctl --user start obsidian-sync.timer

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide instructs users to schedule unattended sync jobs that will transmit vault contents to GitHub, but it does not prominently warn that private notes may be automatically committed and pushed to a remote repository. In the context of an Obsidian vault, this can expose sensitive personal or work information if users misunderstand the scope of what will be synced or misconfigure repository visibility.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 50)May include surrounding context.

bash
# 编辑 crontab
crontab -e

# 每天凌晨3点同步
0 3 * * * /path/to/obsidian-github-sync/scripts/obsidian-sync.sh

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script performs git add -A, auto-commits, rebases, and pushes repository contents without an execution-time confirmation or dry-run mode. In a backup/sync skill, this can unintentionally publish sensitive notes, overwrite expected history, or propagate mistakes to the remote, especially because Obsidian vaults often contain personal or confidential data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

A language/locale policy issue exists when a skill or guide forces a specific language without user opt-in. This setup guide appears fully Chinese-language and does not provide an alternative language option or note that the language constraint is deliberate for a region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This shell script includes natural-language documentation comments exclusively in Chinese for required environment-variable configuration. That suggests a fixed language choice without any user opt-in or alternative locale, which can violate language/locale policy when the skill is expected to be generally usable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script contains natural-language comments and operational guidance in Chinese, which can impose a language expectation on maintainers or users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.