ClawHub
Back to skill

Security audit

Obsidian Local REST API

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Obsidian vault connector that can read, write, and delete notes, but it is scoped to the user’s configured vault and requires confirmation for destructive actions.

Install only if you are comfortable giving OpenClaw a reusable API key with broad access to your Obsidian vault. Use OBSIDIAN_CA_CERT or a CA-trusted reverse proxy, avoid the -k TLS bypass except for exceptional trusted-LAN troubleshooting, confirm exact paths before overwrite or delete actions, and rotate the Obsidian API key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
72% confidence
Finding

The skill includes a documented fallback to set CACERT='-k', which disables TLS certificate verification for authenticated requests carrying a reusable bearer token. Even though it is discouraged and scoped to a 'trusted LAN', normalizing this option weakens transport security and can enable man-in-the-middle interception of the API key and note contents if the network trust assumption is wrong.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
description: Bearer token from Obsidian - Settings - Local REST API. User-supplied; never hard-coded, never echoed.
  optional_env:
    - name: OBSIDIAN_CA_CERT
      description: Path to the plugin's exported certificate, so curl can verify TLS (recommended; avoids disabling verification). See "TLS & credential handling".
  binaries:
    - curl       # HTTP(S) calls to the local Obsidian REST API
    - python3    # parse/format API JSON responses

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

bash
CACERT="--cacert $OBSIDIAN_CA_CERT"   # verified TLS (see "TLS & credential handling")

curl -s $CACERT \
  -H "Authorization: Bearer $OBSIDIAN_API_KEY" \
  "$OBSIDIAN_URL/" \
  | python3 -c "import json,sys; d=json.load(sys.stdin); print('OK — Obsidian', d['versions']['obsidian'], '| Plugin', d['versions']['self'], '| Auth:', d['authenticated'])"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

Check API status (root endpoint only)

bash
curl -s $CACERT -H "Authorization: Bearer $OBSIDIAN_API_KEY" "$OBSIDIAN_URL/"

Returns: {"status":"OK","authenticated":true,"versions":{"obsidian":"1.x.x","self":"3.x.x"}, ...}

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

List a subfolder (trailing slash required)

bash
curl -s $CACERT -H "Authorization: Bearer $OBSIDIAN_API_KEY" "$OBSIDIAN_URL/vault/My%20Folder/" \
  | python3 -c "import json,sys; [print(f) for f in json.load(sys.stdin)['files']]"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

Delete a note (DELETE) — ⚠ confirm first

bash
curl -s $CACERT -X DELETE \
  -H "Authorization: Bearer $OBSIDIAN_API_KEY" \
  "$OBSIDIAN_URL/vault/PATH%2FTO%2FNOTE.md"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

Get currently active file in Obsidian

bash
curl -s $CACERT -H "Authorization: Bearer $OBSIDIAN_API_KEY" "$OBSIDIAN_URL/active/"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

1. Add env vars to your OpenClaw systemd service

bash
sudo nano /etc/systemd/system/openclaw.service

Add these lines in the [Service] block (the CA cert line is optional but recommended):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

1. Add env vars to your OpenClaw systemd service

bash
sudo nano /etc/systemd/system/openclaw.service

Add these lines in the [Service] block (the CA cert line is optional but recommended):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

1. Add env vars to your OpenClaw systemd service

bash
sudo nano /etc/systemd/system/openclaw.service

Add these lines in the [Service] block (the CA cert line is optional but recommended):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

Read a note

bash
curl -s $CACERT -H "Authorization: Bearer $OBSIDIAN_API_KEY" \
  "$OBSIDIAN_URL/vault/PATH%2FTO%2FNOTE.md"

Returns raw Markdown content.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.

Execute an Obsidian command

bash
curl -s $CACERT -X POST \
  -H "Authorization: Bearer $OBSIDIAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"commandId": "editor:save-file"}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 418)May include surrounding context.

Save a runbook

bash
NOTE_PATH="Infrastructure%2FRunbook-$(date +%Y-%m-%d).md"
curl -s $CACERT -X PUT \
  -H "Authorization: Bearer $OBSIDIAN_API_KEY" \
  -H "Content-Type: text/markdown" \
  --data-binary "# Runbook — $(date +%Y-%m-%d)

Static analysis

No suspicious patterns detected.