Security audit

Obsidian Save Article

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent Obsidian article-saving purpose, but its automatic external fetching and weak URL/path safeguards warrant Review before installation.

Review before installing. Use this only with public, non-sensitive article URLs unless you are comfortable sending target URLs through Jina.ai and possibly capturing browser-visible logged-in content. Avoid internal, localhost, file, cloud metadata, private, paywalled, or tokenized links. Configure the vault path carefully and watch disk/network usage until the publisher adds URL allowlisting, private-network blocking, bounded downloads, path containment, and explicit consent for third-party or authenticated-page retrieval.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_images.py:119
Finding: Unrestricted URL Fetching Enables SSRF and Local File Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config.py:27
Finding: Insufficient Vault Path Validation Allows Writes Outside the Intended Directory
Content: View full analysis
3 else "" config = { "type": config_type, "vault_path": vault_path, "subfolder": subfolder } saved = save_config(config) ``` The resulting output path is subsequently trusted by the image downloader: ```python # Create images directory images_dir = os.path.join(output_dir, images_subdir) os.makedirs(images_dir, exist_ok=True) ``` ### Technical Analysis `save_config` combines `vault_path` and `subfolder` without validating either value or verifying that the resulting canonical path remains inside the selected Vault. If `subfolder` is absolute, `os.path.join(vault_path, subfolder)` discards `vault_path`. A relative value containing `..` components can traverse to a parent directory. Symlinks within the selected path may similarly cause the effective destination to resolve outside the Vault. The configuration is then marked as valid and persisted. Later operations trust `full_path`, create an `images` directory beneath it, and write downloaded content there. The standalone downloader also accepts an arbitrary `output_dir` without checking it against the configured Vault. ### Attack Path 1. A malicious or improperly trusted caller invokes the configuration command with a legitim ...[truncated 1016 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_images.py:42
Finding: Unbounded Response and Image Downloads Enable Resource Exhaustion
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill description omits a material data flow: article URLs and fetched content may be sent to the third-party service r.jina.ai. In a tool that claims local Obsidian saving, this mismatch can mislead users into exposing private or sensitive reading targets to an external service without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill description omits a material data flow: article URLs and fetched content may be sent to the third-party service r.jina.ai. In a tool that claims local Obsidian saving, this mismatch can mislead users into exposing private or sensitive reading targets to an external service without informed consent.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The script performs outbound network access to fetch arbitrary article pages, images, and a third-party markdown conversion service, but the finding indicates this capability is not declared in permissions. Undeclared network capability is dangerous because it expands the skill's effective trust boundary and can enable unreviewed data exfiltration or unexpected remote interactions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code sends the user-supplied article URL to https://r.jina.ai/ to obtain markdown, which means article access and potentially sensitive target URLs are disclosed to a third party despite the skill being described as saving content locally. This creates a privacy and data-handling risk because private, internal, tokenized, or otherwise sensitive URLs may be relayed outside the local Obsidian workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Relaying article retrieval through a third-party endpoint is not necessary for the stated purpose of locally saving webpages and therefore introduces an unjustified external data flow. Because the skill context implies a local-only archival action, this mismatch makes the behavior more dangerous by violating user expectations and increasing the chance that sensitive browsing targets are exposed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is presented as a local save helper, but its documented capture path sends URLs and potentially article content through external services and browser-based retrieval. That discrepancy creates a privacy and trust risk because users may reasonably expect purely local handling when saving to a local Obsidian vault.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description and all invocation/setup instructions are presented in Chinese, including required trigger phrases and first-run prompts, with no indication that another language is accepted. This creates a locale/language constraint in the skill's natural-language interface without user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill's allowed tools support persistent writes and command execution, which expands the blast radius of any misuse or prompt-injection-triggered action. Even if intended for normal article saving, these capabilities can create durable local changes and execute helper scripts on behalf of the user.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: 将网页文章保存到本地 Obsidian Vault，支持图片抓取、Markdown 转换、YAML frontmatter 和用户笔记附加。 allowed-tools: - Read - Write - Edit - exec ---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill's allowed tools support persistent writes and command execution, which expands the blast radius of any misuse or prompt-injection-triggered action. Even if intended for normal article saving, these capabilities can create durable local changes and execute helper scripts on behalf of the user.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: 将网页文章保存到本地 Obsidian Vault,支持图片抓取、Markdown 转换、YAML frontmatter 和用户笔记附加。 allowed-tools: - Read - Write - Edit - exec ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill persists configuration data under the user's home directory and writes files into user-specified vault paths, but does not prominently warn about this local persistence. Silent filesystem writes can surprise users, expose sensitive path information, and create unwanted long-term artifacts on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill does not provide a clear user-facing warning that URLs and retrieved content may be sent to Jina.ai. This is dangerous because even a URL alone can reveal sensitive interests, internal resources, or private documents, and fetched page content may also be disclosed to a third party.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The browser fallback explicitly contemplates accessing logged-in or crawler-blocked pages, which broadens the skill from simple article saving into access and extraction of potentially private content. If invoked on authenticated pages, the skill could capture sensitive account-specific data and store it locally or process it unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command-line interface prints status messages in Chinese only, which forces a specific language for users without offering a choice or documenting a justified locale restriction. This matches the policy category for language or locale constraints in natural-language content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script forwards article retrieval to a third-party service without explicit user warning or informed consent beyond routine stderr logging. This is dangerous because users may reasonably believe content is processed locally, while in reality their requested URLs and associated content may be observable by an external provider.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring for clean_html_to_markdown says 'Simple HTML to Markdown conversion,' and convert_html_to_markdown_with_local_images also claims to convert HTML to Markdown. In reality, the implementation only strips script/style tags and returns the remaining HTML without performing substantive markdown conversion, which contradicts the documented intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.