Security audit

Xiaodi Obsidian Brain Pro

Security checks for vulnerabilities and agentic risk

Overview

This Obsidian note skill has a coherent purpose, but it overreaches by reading agent memory and automatically pushing broad local repository changes to network destinations.

Install only after reviewing and constraining the paths, disabling or gating automatic Git push, confirming the remote repository is private and intended, changing Ollama to a trusted local loopback endpoint, and removing OpenClaw memory from the default search paths.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/search_engine.py:16
Finding: OpenClaw Agent Memory Is Indexed Outside the Declared Obsidian Note Scope
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/search_engine.py:14
Finding: Notes, Queries, and Agent Memory Are Sent to a Hardcoded Host over Plaintext HTTP
Content: View full analysis
list: """Call Ollama to obtain a text embedding.""" url = f"{OLLAMA_BASE_URL}/api/embeddings" payload = { "model": OLLAMA_MODEL, "prompt": text } try: response = requests.post(url, json=payload, timeout=30) response.raise_for_status() return response.json().get("embedding", []) ``` ```python content = md_file.read_text(encoding="utf-8") # Get the embedding for the file file_embedding = get_embedding(content[:500]) ``` The user-supplied search query is also transmitted: ```python query_embedding = get_embedding(query) ``` ### Technical Analysis The default Ollama endpoint is a fixed private-network address rather than a loopback address. The script sends the full search query and the first 500 characters of each indexed Markdown file to that endpoint as JSON. Using `http://` provides neither transport encryption nor server authentication. A malicious service at the configured address, a compromised LAN host, or a network attacker capable of interception can observe the submitted text. The endpoint can also be changed through `OLLAMA_BASE_URL`, but the implementation does not validate the scheme, host, or trust status. This behavior conflicts with the project's claims that semantic processing is entirely local and that private content is not uploaded to third-party cloud services. A service on another LAN host is still a network recipient outside the Skill process and local machine. The prompt-level redaction guidance does not reliably protect this channel. The search script performs no deterministic redaction before submitting note content or memory c ...[truncated 1176 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/push_to_git.sh:63
Finding: Git Synchronization Stages and Pushes the Entire Vault Without Enforced Secret Scanning
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/push_to_git.sh:89
Finding: Git Synchronization Silently Executes Unrelated OpenClaw Process Repair
Content: View full analysis
/dev/null; then openclaw doctor --fix-zombies &>/dev/null || true fi ``` ### Technical Analysis After synchronization, both scripts invoke `openclaw doctor --fix-zombies` whenever the `openclaw` executable is available. Process repair is unrelated to committing and pushing Obsidian notes and therefore exceeds the minimum privileges required for synchronization. The command's standard output and standard error are suppressed, and `|| true` ignores failure. Users cannot see what process changes were attempted or whether they succeeded. Depending on the semantics of the installed OpenClaw version, the command may inspect, alter, or terminate process state outside the note repository. The code resolves `openclaw` through the current `PATH`. Although the audit found no evidence that this project modifies or spoofs the executable, running an unrelated PATH-resolved command unnecessarily expands the execution surface. ### Attack Path 1. The user invokes either Git synchronization script. 2. The script completes its normal note synchronization behavior. 3. It checks whether an `openclaw` executable exists in `PATH`. 4. It invokes `openclaw doctor --fix-zombies` without separate user consent. 5. The command performs process-management operations outside the Obsidian repository. 6. All output is discarded, and any error is ignored. If an untrusted executable named `openclaw` appears earlier in `PATH`, this unnecessary invocation also provides an execution opportunity, although no PATH manipulation by this project was identified. ### Impact Assessment The command may affect OpenClaw processes belonging to the executing user and can disrupt active Agent opera ...[truncated 337 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:62
Finding: Installation Instructions Execute a Mutable Unpinned Package Version
Content: View full analysis
Remediation: View remediation
`. 2. Publish and verify package integrity hashes where the installation mechanism supports them. 3. Document the expected registry and package publisher. 4. Use a lockfile or equivalent reproducible dependency mechanism. 5. Review new package versions before updating the documented installation command. 6. Consider an installation method that downloads a versioned artifact and verifies its checksum before execution. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (49)

Tainted flow: 'url' from os.getenv (line 24, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/search_engine.py (reported line 31)May include surrounding context.
python
} try: response = requests.post(url, json=payload, timeout=30) response.raise_for_status() return response.json().get("embedding", []) except Exception as e:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Advertising voice-friendly note conversion while the underlying behavior includes automatic staging, committing, and pushing of local repository changes creates a serious expectation gap. In a note-taking/privacy-focused skill, undisclosed repository modification and remote sync are particularly dangerous because they can persist and exfiltrate highly personal content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Advertising voice-friendly note conversion while the underlying behavior includes automatic staging, committing, and pushing of local repository changes creates a serious expectation gap. In a note-taking/privacy-focused skill, undisclosed repository modification and remote sync are particularly dangerous because they can persist and exfiltrate highly personal content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Advertising voice-friendly note conversion while the underlying behavior includes automatic staging, committing, and pushing of local repository changes creates a serious expectation gap. In a note-taking/privacy-focused skill, undisclosed repository modification and remote sync are particularly dangerous because they can persist and exfiltrate highly personal content.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: This is a duplicate occurrence of the same git push origin main directive. As with the other instance, instructing an agent to perform a remote push creates a clear pathway for unauthorized or accidental publication of transformed user data.
Content: Scanner excerpt · prompts/organizer.txt (reported line 211)May include surrounding context.
text
git fetch origin main git rebase origin/main # 如果冲突：保留双方内容 git push origin main ``` **❌ 禁止操作**：

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: This is a duplicate occurrence of the same git push origin main directive. As with the other instance, instructing an agent to perform a remote push creates a clear pathway for unauthorized or accidental publication of transformed user data.
Content: Scanner excerpt · prompts/organizer.txt (reported line 211)May include surrounding context.
text
git fetch origin main git rebase origin/main # 如果冲突:保留双方内容 git push origin main ``` **❌ 禁止操作**:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: This duplicate finding refers to the same git push origin main behavior and carries the same risk: an agent is instructed to perform a networked repository write automatically. Given the skill's purpose of handling WhatsApp/Telegram-derived notes and pushing them into Obsidian/GitHub workflows, this materially increases the chance of unintended disclosure of personal content or secrets if preprocessing or redaction fails.
Content: Scanner excerpt · prompts/system_prompt_v2.txt (reported line 211)May include surrounding context.
text
git fetch origin main git rebase origin/main # 如果冲突：保留双方内容 git push origin main ``` **❌ 禁止操作**：

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: This duplicate finding refers to the same git push origin main behavior and carries the same risk: an agent is instructed to perform a networked repository write automatically. Given the skill's purpose of handling WhatsApp/Telegram-derived notes and pushing them into Obsidian/GitHub workflows, this materially increases the chance of unintended disclosure of personal content or secrets if preprocessing or redaction fails.
Content: Scanner excerpt · prompts/system_prompt_v2.txt (reported line 211)May include surrounding context.
text
git fetch origin main git rebase origin/main # 如果冲突:保留双方内容 git push origin main ``` **❌ 禁止操作**:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 65% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · prompts/organizer.txt (reported line 215)May include surrounding context.
text
``` **❌ 禁止操作**： - `git reset --hard`（删除本地内容） - `git push --force`（覆盖远程内容） ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 65% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · prompts/system_prompt_v2.txt (reported line 215)May include surrounding context.
text
``` **❌ 禁止操作**： - `git reset --hard`（删除本地内容） - `git push --force`（覆盖远程内容） ---

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The header claims a 'only add, never delete' safety property, but git add -A stages deletions as well, so removed notes can be committed and propagated to the remote repository. This is dangerous because users may rely on the documented safety guarantee and unintentionally sync destructive changes, including mass deletions, under a false sense of protection.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation says the agent will process '任何碎碎念'/'any message content' from WhatsApp or Telegram, implying a broadly triggered skill with minimal scoping. In a messaging context, overbroad activation can cause unintended ingestion of sensitive, irrelevant, or adversarial content, especially since the skill appears to archive user messages into Obsidian notes automatically.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill metadata declares required tools but does not define a clear permission or allowed-tools scope, while the described behavior implies filesystem, environment, and network-capable operations. That mismatch weakens user visibility and policy enforcement, increasing the chance that a skill can access local data or external services beyond what users reasonably expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation mentions automatic backup/sync to GitHub without making the off-device transmission risk sufficiently prominent at the point where the feature is introduced. For a skill handling personal notes, health information, work details, and potentially credentials, insufficient disclosure materially increases the chance of accidental data leakage.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promises to preserve the user's original words and 'only format' content, but it also claims to correct recognition errors and replace sensitive text. That inconsistency can mislead users about evidentiary integrity, which matters if notes are later relied on for memory, records, audits, or personal safety details.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Claiming data is 'absolutely not uploaded to third-party cloud' conflicts with advertising GitHub backup, which is a third-party cloud service even if the repository is private. This can cause users to make unsafe assumptions about data residency and confidentiality for sensitive personal notes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 83% confidence
Finding: Using 'npx clawhub@latest' is effectively an unpinned remote execution path: users may install or run a newer package version than the one reviewed, including a compromised or breaking release. This undermines reproducibility and creates supply-chain risk during installation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This manifest description lists broad functions like intelligent memory enhancement, hallucination correction, privacy desensitization, and voice-input friendliness, but provides no explicit activation phrases, scope limits, or exclusion conditions. In a manifest file, this can make invocation conditions unclear and increase the risk of unintended triggering.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest requests exec in addition to read/write and memory search for a skill presented primarily as Obsidian note organization and memory enhancement. In this context, exec materially increases the blast radius because it can run arbitrary local commands, interact with git, and modify the host beyond the vault, while the manifest does not constrain when or how command execution is limited.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill combines file_write and exec with scheduled agents, creating the possibility of unattended changes to local files or command execution without a clear user-facing warning. In a note-taking skill, autonomous scheduled actions are more dangerous because users may expect passive organization, not potentially impactful system or repository operations happening in the background.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Automatic git backup introduces persistent replication of note contents and potentially metadata into a repository, but the manifest gives no explicit warning about retention, sync targets, or repository updates. For a skill handling personal notes, voice-derived content, and privacy-sensitive material, silent backup can increase exposure even if the repo is intended to be local.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains user-facing natural-language instructions and descriptions exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users can opt into another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide instructs users to create a public repository and then run git add -A followed by git push, which can publish all files in the working directory without any screening for secrets, personal data, or internal artifacts. In the context of a skill that explicitly handles WhatsApp/Telegram data and privacy-related features, this increases the chance of accidental exposure of sensitive content or credentials.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · github-release-guide.md (reported line 12)May include surrounding context.
md
gh auth login # 创建公开仓库 gh repo create obsidian-brain-pro --public --description "拒绝 AI 爹味！这款 Obsidian 插件只记你的原话，不装逼。" # 或创建私有仓库（测试阶段） gh repo create obsidian-brain-pro --private --description "WhatsApp → Obsidian 智能记忆增强"

Static analysis

No suspicious patterns detected.