Obsidian GitHub Sync

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:19 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it can set up unattended jobs that automatically commit and push an entire Obsidian vault to GitHub.

Review this carefully before installing. Use it only with a repository you have verified, preferably private, and inspect .gitignore and git status before the first push. Avoid enabling cron or systemd automation until you are comfortable with unattended commits and uploads, and keep removal commands handy.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: references/setup-guide.md:45
• Finding: Persistent Unattended Vault Synchronization Through Scheduled Tasks## Vulnerability Details **File Locations**: - `SKILL.md:34-42` - `SKILL.md:125-168` - `references/setup-guide.md:45-66` **Vulnerability Type**: Scheduled task and user-service persistence **Risk Level**: High ### Vulnerable Code `references/setup-guide.md:45-66`: ```bash ### 使用 Cron (Linux/Mac) ```bash # 编辑 crontab crontab -e # 每天凌晨3点同步 0 3 * * * /path/to/obsidian-github-sync/scripts/obsidian-sync.sh # 每天早上9点检查冲突 0 9 * * * /path/to/obsidian-github-sync/scripts/check-conflict.sh ``` ### 使用 OpenClaw Cron ```bash openclaw cron add --name "obsidian-sync" \ --cron "0 3 * * *" \ --command "/path/to/obsidian-github-sync/scripts/obsidian-sync.sh" openclaw cron add --name "obsidian-check" \ --cron "0 9 * * *" \ --command "/path/to/obsidian-github-sync/scripts/check-conflict.sh" ``` ``` `SKILL.md:125-168`: ```bash ### With OpenClaw ```bash # Add sync cron job openclaw cron add --name "obsidian-sync" \ --cron "0 3 * * *" \ --command "/path/to/obsidian-sync.sh" # Add conflict check openclaw cron add --name "obsidian-check" \ --cron "0 9 * * *" \ --command "/path/to/check-conflict.sh" ``` ### With Systemd (Linux) Create `~/.config/systemd/user/obsidian-sync.service`: ```ini [Unit] Description=Obsidian Vault Git Sync [Service] Type=oneshot Environment="OBSIDIAN_VAULT_DIR=/path/to/vault" Environment="GITHUB_REMOTE_URL=[e-mail]:user/repo.git" ExecStart=/path/to/obsidian-sync.sh ``` Create `~/.config/systemd/user/obsidian-sync.timer`: ```ini [Unit] Description=Run Obsidian sync daily at 3 AM [Timer] OnCalendar=*-*-* 03:00:00 Persistent=true [Install] WantedBy=timers.target ``` Enable: ```bash systemctl --user daemon-reload systemctl --user enable obsidian-sync.timer systemctl --user start obsidian-sync.timer ``` ``` ### Technical Analysis The Skill instructs users to register recurring cron or ...[truncated 3112 chars]
• Remediation: ## Remediation Suggestions 1. Keep manual synchronization as the default and make scheduled execution explicitly opt-in. 2. Before installation, clearly disclose that the job survives the current session, runs without per-run approval, and may upload all unignored vault content. 3. Require users to verify the repository URL, repository visibility, selected branch, `.gitignore`, and staged files before enabling automatic pushes. 4. Provide removal commands alongside installation instructions: - Remove the relevant entries with `crontab -e`. - Remove OpenClaw jobs using the applicable OpenClaw deletion command. - Disable and remove the systemd timer and service files. 5. Place scheduled scripts in a user-owned directory that is not writable by other users, and use canonical absolute paths. 6. Restrict permissions on the script, service, timer, log, and conflict-marker files. 7. Add integrity validation or deploy a protected immutable copy of the script before scheduling it. 8. Consider separating commit creation from network upload so unattended operation does not push sensitive content without review. 9. Add a dry-run or staging review mode and exclude sensitive Obsidian files through a secure default `.gitignore`. 10. Avoid `Persistent=true` unless catch-up execution is specifically requested and its behavior is clearly explained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

• Category: Privilege Escalation

Content

```bash
ssh-keygen -t ed25519 -C "[e-mail]"
cat ~/.ssh/id_ed25519.pub
# 将公钥添加到 GitHub Settings -> SSH and GPG keys
```

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases include broad, common language such as 'vault backup' and 'sync my notes', which can cause the skill to activate in contexts where the user did not specifically request GitHub-based Obsidian synchronization. Unintended invocation is risky here because the skill describes automation that can commit, pull, and push note data, potentially causing unwanted repository changes or exposure of sensitive notes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill advertises automatic sync behavior but does not prominently warn users that it may auto-commit local changes and push note contents to a remote GitHub repository. In this context, that omission can lead users to expose sensitive personal notes, overwrite expected history, or create persistent automation without fully understanding the consequences.

Session Persistence

Medium

• Category: Rogue Agent

Content

↓
pull --rebase fails (remote has divergent changes)
    ↓
Create conflict flag file
    ↓
Exit with error
    ↓

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Enable:
```bash
systemctl --user daemon-reload
systemctl --user enable obsidian-sync.timer
systemctl --user start obsidian-sync.timer
```

• Confidence: 85% confidence
• Finding: The documented use of 'systemctl --user enable' establishes persistent scheduled execution of the sync task across sessions. Persistence is expected for automation, but in a skill context it increases risk because a one-time setup can continue committing and pushing note data without repeated user review, especially if the repository or vault path is misconfigured.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide instructs users to schedule unattended sync jobs that will transmit vault contents to GitHub, but it does not prominently warn that private notes may be automatically committed and pushed to a remote repository. In the context of an Obsidian vault, this can expose sensitive personal or work information if users misunderstand the scope of what will be synced or misconfigure repository visibility.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 编辑 crontab
crontab -e

# 每天凌晨3点同步
0 3 * * * /path/to/obsidian-github-sync/scripts/obsidian-sync.sh

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script performs `git add -A`, auto-commits, rebases, and pushes repository contents without an execution-time confirmation or dry-run mode. In a backup/sync skill, this can unintentionally publish sensitive notes, overwrite expected history, or propagate mistakes to the remote, especially because Obsidian vaults often contain personal or confidential data.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: A language/locale policy issue exists when a skill or guide forces a specific language without user opt-in. This setup guide appears fully Chinese-language and does not provide an alternative language option or note that the language constraint is deliberate for a region-specific audience.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This shell script includes natural-language documentation comments exclusively in Chinese for required environment-variable configuration. That suggests a fixed language choice without any user opt-in or alternative locale, which can violate language/locale policy when the skill is expected to be generally usable.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The script contains natural-language comments and operational guidance in Chinese, which can impose a language expectation on maintainers or users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Static analysis

No suspicious patterns detected.