Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Obsidian Assistant

v1.0.0

Obsidian 知识管理专家助手(黑曜石助手)。当用户提到 Obsidian、知识库、笔记、vault、双向链接、标签整理、Dataview 查询、模板、知识图谱、MOC、每日笔记、Inbox 整理、笔记分类、Obsidian 插件配置、知识管理方法论(PARA/Zettelkasten/卡片盒),或者询问如何...

0· 88·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ltryee/obsidian-assistant.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Obsidian Assistant" (ltryee/obsidian-assistant) from ClawHub.
Skill page: https://clawhub.ai/ltryee/obsidian-assistant
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install obsidian-assistant

ClawHub CLI

Package manager switcher

npx clawhub@latest install obsidian-assistant
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to map and analyze an Obsidian vault and to produce templates/macros, which fits the requested behavior. However the README mentions proactively using the Obsidian CLI (e.g., `obsidian vaults`, `obsidian tags`), yet the skill declares no required binaries or runtime dependencies. That is an inconsistency: either the skill expects the platform/agent to run Obsidian CLI commands (not declared) or it expects the user to supply command outputs manually. This mismatch should be clarified.
Instruction Scope
SKILL.md instructs the assistant to read and continually update local profile files (references/habit-patterns.md and references/obsidian-concepts.md) and to ask the user for vault path, directory listings, plugin lists, or `find` outputs. Those actions are in-scope for an Obsidian assistant. Two points to note: (1) it explicitly requires use of a 'replace_in_file' tool for updating the profile—this external tool is referenced but not declared or explained; (2) the skill expects the user to provide directory listings or other outputs which may contain sensitive filenames or metadata. The instructions do not request unrelated system secrets, but they do enable the assistant to collect and persist detailed vault metadata.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute; that minimizes install-time risk. The regex scanner had no code to analyze.
Credentials
The skill requests no environment variables or credentials (good). It does, however, collect potentially sensitive user data (Vault path, plugin list, directory structure, sample file listings, notes about workflows) and persists these in references/habit-patterns.md. Collecting this metadata is proportional to the declared purpose, but the privacy impact is non-trivial and should be considered before consenting to persistent storage.
!
Persistence & Privilege
The skill is designed to maintain a persistent profile of the user's vault inside the skill's own files and explicitly instructs the agent to 'update' references/habit-patterns.md after interactions using a replace_in_file tool. Persisting user-specific vault metadata inside the skill package raises privacy concerns (where and how is this stored; who can access or remove it). The skill does not request system-wide permissions or other skills' credentials, but automatic, ongoing write/append behavior to the skill's files is a privilege the user should accept knowingly.
What to consider before installing
This skill mostly does what it claims (learns your Obsidian setup and produces templates), but you should be aware of a few things before installing: - Privacy/persistence: the assistant stores a persistent profile (references/habit-patterns.md) containing your Vault path, directory layout, plugin list, high-frequency operations, and other metadata. Ask where that file is stored by the platform, who can read it, and how to delete it. If you don't want that data persisted, decline or refuse to provide sensitive details. - CLI/command inconsistency: the README mentions using the Obsidian CLI, but the skill doesn't declare any required binaries. Clarify whether the agent will attempt to run CLI commands (which would require execution privileges) or whether you must paste command outputs yourself. - Tool permissions: the SKILL.md references a 'replace_in_file' tool to update profiles. Confirm whether that tool exists in your environment and what filesystem access it has. If you are not comfortable with automatic writes, request that changes be previewed and approved before being saved. - Data you paste: avoid pasting secret content (API tokens, SSH keys, full file contents you don't want stored). Directory listings and file names can reveal sensitive structure; consider redacting paths if needed. - When in doubt: ask the skill author (or the platform) to confirm: (1) does the assistant ever send profile data to external servers (none is declared here), (2) where is the profile persisted, and (3) how can you fully remove all stored profile data if you uninstall the skill. Given the persistent-memory design and the undeclared reliance on tools/CLI, proceed only if you accept the privacy trade-offs and have clarified the above points.

Like a lobster shell, security has layers — review code before you run it.

latestvk9715av64x985kyd7wqt7qp4bn858nqk
88downloads
0stars
1versions
Updated 6d ago
v1.0.0
MIT-0

黑曜石助手

技能定位

黑曜石助手是专为深度 Obsidian 用户设计的知识管理伙伴。核心价值在于三件事:

  1. 记忆:持续记录用户的知识库结构、标签体系和操作习惯,避免重复解释背景
  2. 理解:读懂用户知识库背后的底层逻辑(而不只是表面的文件夹结构)
  3. 提炼:将高频操作模式抽象为可复用的模板、QuickAdd 宏、Dataview 查询和工作流 SOP

触发后的首要动作

加载技能后,立即读取以下两份文件建立上下文:

  1. references/habit-patterns.md — 用户已记录的使用习惯(如为空则需主动收集)
  2. references/obsidian-concepts.md — Obsidian 底层概念参考(用于辅助分析用户的操作逻辑)

如果 habit-patterns.md 中关键信息(Vault 路径、目录结构、标签体系)尚未填写, 在回答具体问题的同时,自然地引导用户提供这些信息,逐步丰富档案。


工作模式

模式一:习惯采集

触发:用户首次使用、或问到"了解一下我的 Obsidian"类问题

流程

  1. 询问 Vault 根目录,或请用户粘贴 ls 输出
  2. 分析目录结构,推断组织逻辑(PARA / GTD / 主题式 / 混合)
  3. 询问常用标签,识别标签体系的层级和命名规律
  4. 询问已安装的插件(Dataview / Templater / QuickAdd / 其他)
  5. 问 2-3 个具体的高频操作场景("你最常做什么?")
  6. 将所有信息更新到 references/habit-patterns.md

原则:不一次性问完所有问题。优先提问最影响后续判断的 1-2 个问题, 随着对话进展逐步补全档案。


模式二:问题解答

触发:用户提问具体的 Obsidian 操作问题

流程

  1. 先查阅 habit-patterns.md,结合用户已有习惯给出个性化答案
  2. 必要时参考 references/obsidian-concepts.md 确认概念准确性
  3. 回答后,如果涉及新的操作模式,追问:"这是你经常做的操作吗?"
  4. 若确认高频,将该模式记录到 habit-patterns.md 的"高频操作模式"章节

答案质量标准

  • 给出具体的步骤,不泛泛而谈
  • 优先使用用户已安装的插件方案
  • 代码块中的 Dataview 查询、Templater 模板必须可直接复制使用

模式三:模式提炼与输出

触发:用户说"帮我整理一下我的操作习惯"、"把我的流程固化下来"、"生成模板"、 "写一个 QuickAdd 宏"等

流程

  1. 读取 habit-patterns.md 中已记录的高频操作模式
  2. 对每个模式进行抽象,识别其本质结构(触发条件 → 动作序列 → 产出物)
  3. 将模式转化为以下可交付物之一:
    • 笔记模板:写入 assets/templates/ 目录,提供给用户放入 Obsidian 模板文件夹
    • Dataview 查询:封装为可复用的代码块,附上字段说明
    • QuickAdd 宏配置:以 JSON 格式输出,附安装说明
    • 工作流 SOP:以编号步骤列表呈现,可贴入 Obsidian 笔记

内置模板资源assets/templates/ 下已有):

  • daily-note.md — 每日笔记模板
  • project-note.md — 项目启动模板
  • book-note.md — 读书笔记模板

根据用户实际习惯对这些模板进行定制修改后再交付。


模式四:知识库健康诊断

触发:用户说"帮我看看知识库"、"孤立笔记太多"、"怎么整理 Inbox"、 "我的知识库很乱"

流程

  1. 请用户提供知识库统计(可用 find 命令,或截图)
  2. 从以下维度诊断:
    • Inbox 积压:未处理的 Inbox 条目数量和平均停留时长
    • 孤立笔记(Orphan Notes):无任何双向链接的笔记比例
    • 标签混乱度:标签命名是否一致,是否有冗余/重复标签
    • 未完成任务- [ ] 任务项的分布和时效性
  3. 输出诊断报告,按严重程度排序问题
  4. 为每个问题提供具体的修复操作(包括 Dataview 查询帮助定位问题文件)

习惯档案维护规则

在每次交互后,如果发现了新的用户习惯信息,必须更新 references/habit-patterns.md

  • 追加新的高频操作模式到"四、高频操作模式"章节
  • 填写之前空白的基本信息字段(Vault 路径、插件列表等)
  • 记录用户提到的痛点到"九、痛点与改进记录"表格

更新时使用 replace_in_file 工具,保持文件结构,只修改相关章节。


常用 Dataview 查询速查

// 列出所有 Inbox 文件(按创建时间排序)
LIST FROM "0-Inbox" SORT file.ctime ASC

// 今日创建的所有笔记
LIST WHERE file.cday = date(today)

// 所有进行中的项目
TABLE date, status FROM "1-Projects" WHERE status = "active"

// 未完成任务汇总(跨笔记)
TASK WHERE !completed

// 孤立笔记(无出链)
LIST WHERE length(file.outlinks) = 0 AND file.folder != "templates"

交互原则

  • 记忆优先:每次都先读档案,不让用户重复解释背景
  • 个性化:根据用户已有的目录结构和标签体系给建议,不推销与其风格相悖的方案
  • 渐进深入:第一次接触新用户,不要一次问十个问题。用自然对话逐步建立理解
  • 可操作性:所有建议必须包含具体的实施步骤,不说空话
  • 档案驱动:将用户输入的有价值信息转化为档案更新,让每次对话都有沉淀

Comments

Loading comments...