Security audit

Xiaodi Obsidian Brain Pro

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent Obsidian memory workflow, but it can automatically store, index, and push sensitive notes with under-scoped controls and conflicting privacy claims.

Review carefully before installing. Use it only with a verified private Obsidian repository, confirm the Git remote, change the Ollama endpoint to a trusted local address if needed, disable or manually review auto-sync, and do not rely on the redaction rules as complete protection for secrets or sensitive personal notes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill metadata declares only tools `memory_search`, `exec`, and `write`, but the documented behavior also implies reading local files, using environment/config values, and making networked requests to Ollama and optionally GitHub. This permission/capability mismatch is dangerous because users and reviewers may grant the skill more trust than warranted, while the skill can access sensitive local notes and potentially transmit data to external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose emphasizes local note capture, hallucination correction, and privacy desensitization, but the described behavior expands into semantic indexing over local notes, filesystem reads from fixed paths, network calls to an embedding endpoint, Git-based synchronization, and external command execution. That mismatch materially increases risk because sensitive personal notes may be scanned, indexed, or transmitted in ways the user would not reasonably infer from the headline description.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The prompt frames itself as a formatting tool, but it also instructs automatic persistence and remote Git push operations. This creates a real security boundary crossing: user messages may be written to disk and transmitted to a repository without clear, explicit per-message consent, which can expose sensitive personal or operational data despite partial redaction rules.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The script explicitly claims a safety property of 'only add, never delete' but later uses 'git add -A', which stages deletions as well as additions and modifications. This mismatch can mislead users into trusting the script with valuable notes, increasing the chance of unintended data loss being committed and pushed.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The comment suggests that rebasing enforces a non-destructive 'only add, never delete' policy, but rebase simply replays commits and does not prevent file removals or destructive history outcomes in the working tree. Users may rely on this false assurance and run the script in situations where rebased commits propagate deletions they expected to be blocked.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The script invokes an unrelated external tool, 'openclaw doctor --fix-zombies', after completing a Git sync, even though that action is outside the stated Obsidian synchronization purpose. Calling an unexpected binary from PATH expands the attack surface: a malicious or trojaned 'openclaw' executable could run arbitrary code whenever the sync script is executed.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script reads local note contents and sends them to an Ollama HTTP embedding endpoint, while the skill description emphasizes privacy-preserving local memory processing. Because the default endpoint is a LAN IP over plain HTTP, sensitive note content may be disclosed to another host or intercepted on the network, which is especially dangerous for personal memory/knowledge data.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The code searches ~/.openclaw/workspace/memory in addition to Obsidian note paths, expanding the data scope beyond what users would reasonably expect from the stated WhatsApp/Telegram-to-Obsidian workflow. In a memory-assistant skill, broadening the search corpus can expose unrelated private files and increases the chance that sensitive workspace content is embedded and transmitted externally.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The script's safety claim is misleading: `git add -A` stages deletions as well as additions, and `git rebase origin/$REMOTE_BRANCH` rewrites local history. In a note-sync context, this can cause unintended data loss, silent deletion propagation, or difficult recovery because users may trust the 'only add, never delete' comment and run it without reviewing changes.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script executes an unrelated external program, `openclaw doctor --fix-zombies`, outside the stated Obsidian sync purpose. Any unexpected executable on `PATH` with that name would run with the user's privileges, creating unnecessary command-execution risk and expanding the attack surface for a sync script that users may schedule automatically.

Vague Triggers

High

Confidence: 86% confidence
Finding: The README states that sending '任何碎碎念' in WhatsApp or Telegram will cause the skill to immediately preserve the message, which implies triggering on ordinary conversation without a clear scoped invocation boundary. In a messaging context, this can cause accidental activation and unintended capture of private or unrelated content into Obsidian, especially because the skill is designed to persist conversational input as notes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The description says the user can send arbitrary WhatsApp or Telegram messages and the agent will '封存记忆', but it does not clearly warn that those messages are being written into local Obsidian notes. Because the skill handles spontaneous personal speech and emphasizes privacy-sensitive use cases, lack of explicit disclosure increases the risk of users unintentionally storing sensitive, regulated, or embarrassing content in a durable knowledge base.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation scope is broad and underspecified, so ordinary WhatsApp-style content could be ingested and processed as publishable notes without a clear trigger or exclusion boundary. In a skill that can save and push content remotely, ambiguous activation materially increases the chance of unintended collection and exfiltration of private information.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow includes creating files and pushing them to Git, but the prompt does not clearly and prominently warn users that their content will be stored locally and transmitted to a remote repository. This lack of informed consent is dangerous because users may share credentials, health details, or personal thoughts believing they are only being reformatted, not persisted and published.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script stages, commits, and pushes all detected changes in the Obsidian directory automatically, without preview or confirmation. In a note vault that may contain sensitive data, accidental files, or unintended edits, this can cause confidentiality and integrity issues by publishing content the user did not intend to sync.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script transmits query text and note excerpts/content to an embedding service over HTTP without any visible user-facing warning or consent flow. Even if the service is intended to be local, the configured endpoint may be remote or network-accessible, making silent disclosure of personal notes a meaningful privacy vulnerability in this skill context.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.