MH obsidian

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:35 PM UTC
• Version: 1.0.0

Overview

This Obsidian helper skill is coherent and purpose-aligned, with ordinary note-management risks users should understand before using write or delete commands.

Install only if you are comfortable trusting the obsidian-cli Homebrew tap, and treat create, move, direct edit, and delete commands as real changes to your Obsidian vault. Confirm the target vault and note path before destructive actions, and rely on backups, sync history, or version control for recovery.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned CLI Dependency from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–19
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

"install":
  [
    {
      "id": "brew",
      "kind": "brew",
      "formula": "yakitrak/yakitrak/obsidian-cli",
      "bins": ["obsidian-cli"],
      "label": "Install obsidian-cli (brew)",
    },
  ],

Technical Analysis

The Skill instructs users to install obsidian-cli from the third-party Homebrew tap yakitrak/yakitrak. The dependency is not pinned to a reviewed version, immutable commit, or verified artifact checksum. Consequently, the executable installed under the expected obsidian-cli name can change after the Skill has been reviewed.

This is a supply-chain trust risk rather than evidence that the current dependency is malicious. If the tap, upstream repository, release process, or maintainer account is compromised, an attacker could modify the formula or referenced artifact. A later installation or upgrade could then execute attacker-controlled installation logic or deploy a modified CLI.

Attack Path

1. An attacker compromises the third-party tap, its maintainer account, its upstream release infrastructure, or another component used by the formula.
2. The attacker changes the formula or referenced artifact to distribute a malicious obsidian-cli executable or installation action.
3. A user follows the Skill’s installation metadata or upgrades the unpinned package.
4. Homebrew retrieves and installs the modified dependency.
5. Installation logic or the modified CLI executes with the privileges of the installing user.
6. When invoked, the malicious CLI can access files available to that user, including discovered Obsidian vaults and their note contents, and could modify or transmit that data.

Impact Assessment

Successful exploitation would provide code execution with the installing or invoking user’s ...[truncated 390 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed, immutable release or commit rather than accepting whichever formula version is current at installation time.
• Verify downloaded artifacts using a published cryptographic checksum or signature.
• Prefer an official, well-maintained package source when one is available.
• Document the dependency’s canonical upstream repository and expected publisher so users can verify provenance.
• Review the Homebrew formula and its artifact URLs before approving installation or upgrades.
• Use automated dependency monitoring to detect changes in ownership, release provenance, checksums, or formula behavior.
• Run the CLI with least privilege and restrict its access to only the vaults required for the task.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file documents the obsidian-cli delete "path/note" command but provides no warning that it removes user content and may be irreversible. Under the markdown-file criteria, destructive behaviors that can affect user data should be accompanied by a clear warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.