ClawHub
Back to skill

Security audit

Obsidian Litiao

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small Obsidian helper whose file access and note changes match its stated purpose, with some install and deletion-risk cautions users should understand.

Before installing, confirm you trust the obsidian-cli Homebrew tap and understand that the skill can search, edit, move, and delete notes in the selected Obsidian vault. Ask the agent to confirm the vault and note path before delete, rename, or bulk changes, and keep backups for important vaults.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding
Unpinned Executable Dependency from a Third-Party Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml metadata: {"clawdbot":{"emoji":"💎","requires":{"bins":["obsidian-cli"]},"install":[{"id":"brew","kind":"brew","formula":"yakitrak/yakitrak/obsidian-cli","bins":["obsidian-cli"],"label":"Install obsidian-cli (brew)"}]}} ``` ### Technical Analysis The Skill requires `obsidian-cli` and provides an installation definition that retrieves it from the third-party Homebrew tap `yakitrak/yakitrak`. The dependency is not pinned to a reviewed version, commit, package digest, or integrity checksum. Consequently, the executable and its installation behavior can change after this Skill has been reviewed. If the third-party tap, formula repository, maintainer account, or upstream release process is compromised, a later installation could retrieve and execute attacker-controlled content. The declared homepage points to official Obsidian documentation, but it does not establish trust in or integrity of the separately maintained CLI package. The project does not itself contain a malicious payload, and the available files provide no evidence that the current dependency is malicious. This finding concerns the mutable and insufficiently verified dependency source. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its maintainer account, the formula source, or an artifact referenced by the formula. 2. The attacker publishes a modified formula or replaces an upstream artifact with a malicious version. 3. A user or Agent follows the Skill installation metadata and installs `yakitrak/yakitrak/obsidian-cli`. 4. Homebrew processes the attacker-controlled formula or package content. 5. Malicious code executes in the installing user's security context. 6. The malicious process can access resources available to that user, potentially including Obsidian configuration, vault paths, not ...[truncated 764 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed, immutable release rather than tracking a mutable formula. 2. Verify downloaded artifacts with a cryptographic checksum from a separately trusted source. 3. Document the CLI's actual upstream repository and maintainers instead of relying only on the official Obsidian documentation homepage. 4. Prefer a trusted package source with stronger review and provenance controls where one is available. 5. If the third-party tap must be retained, pin its reviewed commit and regularly reassess the formula, artifact URL, checksum, and installation hooks. 6. Add provenance or signature verification before installation where supported. 7. Clearly inform users that the CLI is a third-party component and that installation executes code with their user-level privileges. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly documents create, move, and delete operations against a user's Obsidian vault without any warning that these commands modify or permanently remove user data. In a note-management skill this functionality is expected, but the lack of safety guidance increases the risk of accidental destructive actions, especially because moves can rewrite links across the vault and deletes target user content directly.

Static analysis

No suspicious patterns detected.