Security audit

Clawnoter Obsidian

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent article-saving purpose, but it needs Review because it can fetch unrestricted URLs, disclose submitted links to Jina.ai, and write outside the intended vault under unsafe configuration.

Install only if you are comfortable with the skill contacting target websites and Jina.ai, downloading page-selected images, scanning common local folders for Obsidian vaults, and writing generated notes to disk. Avoid using it with private, signed, internal, localhost, or token-bearing URLs until URL validation, size limits, vault containment checks, and a Jina opt-in or local-only mode are added.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:39
Finding: Mandatory Promotional Content Injected into Agent Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_images.py:359
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/download_images.py:376
Finding: Complete User-Supplied Article URLs Are Disclosed to Jina Reader
Content: View full analysis
`. 4. The request exposes the complete URL to Jina's infrastructure. 5. Jina may subsequently request the target resource, and the submitted URL may enter third-party operational logs. ### Impact Assessment The issue can disclose URL-level secrets and browsing targets to an external service. It does ...[truncated 279 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config.py:111
Finding: Subfolder Traversal Can Escape the Configured Obsidian Vault
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/save_article.py:71
Finding: Unsafe String Interpolation Allows YAML Frontmatter Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_images.py:268
Finding: Unbounded Response Reads Permit Memory and Disk Exhaustion
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp1

High

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The script performs outbound network access to arbitrary user-supplied article URLs, downloads remote images, and also contacts an external service. If the skill's declared permissions do not include network access, this creates a capability mismatch that can expose users to unexpected data exfiltration, SSRF against internal resources, or policy bypass. In the context of a skill advertised as saving web articles locally, network use to fetch the page is expected, but undeclared network capability is still security-relevant because users and permission systems cannot accurately assess what the skill does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that the primary fetch path sends target URLs to https://r.jina.ai/<URL>, which means user-requested pages are disclosed to a third-party service. Because this behavior is documented without a clear privacy warning, consent model, or explanation of what metadata may be exposed, users may unknowingly leak sensitive internal, private, or identifying links during normal use.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The combination of Write, Edit, and exec permissions gives the skill durable filesystem access and the ability to invoke local scripts. Although necessary for saving articles, this enlarges the attack surface if untrusted input such as user-supplied paths, URLs, or note text is passed into scripts or used to determine filesystem targets without strong validation.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: 将网页文章保存到本地 Obsidian Vault，支持图片抓取、Markdown 转换、YAML frontmatter 和用户笔记附加。 allowed-tools: - Read - Write - Edit - exec ---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The combination of Write, Edit, and exec permissions gives the skill durable filesystem access and the ability to invoke local scripts. Although necessary for saving articles, this enlarges the attack surface if untrusted input such as user-supplied paths, URLs, or note text is passed into scripts or used to determine filesystem targets without strong validation.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: 将网页文章保存到本地 Obsidian Vault,支持图片抓取、Markdown 转换、YAML frontmatter 和用户笔记附加。 allowed-tools: - Read - Write - Edit - exec ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill defaults to fetching article content through Jina.ai but does not clearly disclose to users that submitted URLs and potentially retrieved page content are sent to a third-party service. This is a privacy and data-handling risk, especially when users save internal, private, or sensitive links under the assumption that processing is local.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module reads Obsidian's application config and recursively scans broad user directories such as Documents, Desktop, and Mobile Documents to discover vaults. For a skill whose stated purpose is saving content to a user-configured vault, this is excessive filesystem enumeration that exposes private directory structure and application state, increasing privacy risk and collecting more local metadata than necessary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code prints user-facing status text in Chinese for the CLI path, including success, error, and configuration messages. The file provides no language selection, fallback, or documentation that the tool is intentionally Chinese-only, which creates a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The set and clear command flows emit user-visible messages only in Chinese, again without any opt-in or documented regional restriction. Because these are primary interaction paths, the forced locale is a consistent policy issue rather than an isolated string choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code sends the user-provided article URL to https://r.jina.ai for markdown extraction, which means a third party learns what the user is saving and may fetch/process the target content externally. This contradicts the local-save expectation in the skill description and creates a privacy/data-handling issue, especially if users save private, sensitive, intranet, or tokenized URLs. The skill context makes this more dangerous because users are likely to assume content stays local except for the original site being fetched.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script fetches article content and downloads images via process_article(url, output_dir), which implies network access and data transmission based on a user-supplied URL. While the module docstring mentions fetching and downloading, there is no runtime confirmation, user-facing notice, or explicit warning near execution that external network requests will be made.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The trigger examples are exclusively in Chinese, including operational commands such as saving and reconfiguration, but the README does not say whether other languages are supported or whether Chinese is required. This can amount to an implicit language constraint without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest description and the entire user-facing instruction set are presented in Chinese, including trigger phrases and setup prompts, with no indication that other languages are supported or that Chinese is optional. This can amount to a language/locale policy issue when the skill effectively forces a specific language without opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The setup flow injects promotional content for a Chrome extension and an unrelated community during a task that is supposed to configure article saving to Obsidian. This creates an unnecessary trust and social-engineering surface, because users may be nudged toward external products or communities without a security or functional need tied to the requested action.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The stated purpose is saving webpage articles to a local Obsidian vault with images and markdown conversion. While fetching webpages is expected, embedding a full browser automation stack to render pages is a materially broader capability than the manifest describes, especially since it can execute page scripts and access dynamically rendered content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code writes a generated markdown note to disk, which changes user data in the specified output directory. Although the module docstring says it writes an Obsidian note, the execution path provides no print/log message or confirmation indicating the exact file write that is about to occur.
Content: No source excerpt is available for this finding.