Obsidian

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:25 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Obsidian helper, but users should understand it can install a third-party CLI and modify or delete notes when directed.

Install only if you are comfortable trusting the yakitrak/yakitrak Homebrew tap for obsidian-cli. Before using create, move, or delete operations, confirm the selected vault and note path, and keep recoverable backups of important Obsidian vaults.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Dependency Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Third-party supply-chain dependency without version or integrity pinning
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"💎","requires":{"bins":["obsidian-cli"]},"install":[{"id":"brew","kind":"brew","formula":"yakitrak/yakitrak/obsidian-cli","bins":["obsidian-cli"],"label":"Install obsidian-cli (brew)"}]}}

Technical Analysis

The installation metadata directs users or an agent to install obsidian-cli from the third-party Homebrew tap yakitrak/yakitrak. The dependency is not pinned to an immutable release or commit, and the Skill does not specify a checksum, signature, or other integrity-verification mechanism.

A Homebrew installation can execute formula installation logic and install binaries controlled by the tap maintainer. Consequently, the code executed during installation and subsequent command invocations may differ from the dependency originally reviewed. If the tap, its maintainer account, its source artifacts, or its distribution infrastructure is compromised, a malicious dependency could be delivered through the documented installation workflow.

The audit found no evidence that the current dependency is malicious. The finding concerns the absence of safeguards against third-party supply-chain compromise.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, or an upstream artifact referenced by its formula.
2. The attacker modifies the formula or distributed obsidian-cli binary to include malicious installation or runtime behavior.
3. A user or agent follows the Skill metadata and installs yakitrak/yakitrak/obsidian-cli.
4. Homebrew executes the compromised formula logic or installs the attacker-controlled binary.
5. The malicious code runs with the privileges of the user performing installation or invoking obsidian-cli.

...[truncated 689 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official, project-controlled distribution source or a trusted package repository where one is available.
2. Pin the dependency to an audited, immutable version or source commit instead of tracking a mutable third-party formula.
3. Verify downloaded artifacts using published cryptographic checksums or signatures before installation.
4. Record the expected source repository, release identifier, checksum, and verification procedure in the Skill metadata or installation documentation.
5. Review the Homebrew formula and its upstream artifact URLs before approving updates.
6. Use automated dependency monitoring and require security review when the formula, source repository, or artifact checksum changes.
7. Run installation and vault operations with the minimum necessary user permissions and maintain recoverable backups of vault data.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file instructs users to run obsidian-cli delete "path/note" but provides no warning that the command removes user data or may be irreversible. Because the skill description includes a destructive operation affecting user notes, it should disclose the risk to user data or recommend confirmation/backup behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.