T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sync.py:125- Finding
Personal Contact Data Stored in an Unprotected Plaintext Ontology File
- Content
View full analysis
- Remediation
View remediation
Security audit
Obsidian Ontology Sync
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it automatically turns private Obsidian notes into persistent, searchable files containing contact and team-behavior data without enough privacy, retention, or access-control safeguards.
Install only if you are comfortable with private Obsidian content, including contacts and team-status information, being copied into persistent searchable files. Use a narrow config, run dry-run first, avoid syncing sensitive or employee-monitoring notes unless authorized, protect the output directory with restrictive permissions, and review or purge graph.jsonl and feedback reports regularly.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README promotes automatic scanning of personal knowledge base notes and generation of ontology and feedback artifacts, but it does not warn that sensitive content from notes may be extracted, normalized, and persisted into new machine-queryable files. In a PKM context, notes commonly contain private contacts, emails, phone numbers, client data, and internal relationship mappings, so silent replication into graph storage increases exposure and can create secondary data stores that are less protected or more broadly queried.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill clearly describes reading from multiple note directories and writing generated ontology, feedback, logs, and potentially modifying notes, yet it does not declare any explicit tool scope or permission boundaries. This is dangerous because an agent or runtime may grant broader file access than intended, increasing the risk of overcollection, unintended file modification, or abuse if the skill is misused or later extended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is designed to automatically extract and persist sensitive personal and business data, including names, emails, phones, response patterns, and behavioral information, but it provides no explicit privacy notice, consent model, retention guidance, or warning to the user. This is dangerous because it normalizes surveillance-style data processing and could lead to unauthorized collection, profiling, and long-term storage of sensitive information from personal notes or team records.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples explicitly show extraction of PII such as email addresses, phone numbers, company affiliations, and meeting history into a structured graph without any adjacent warning about sensitivity or safe handling. This is dangerous because examples shape implementation and user expectations, encouraging broad ingestion of private data into machine-queryable storage where it becomes easier to search, correlate, and misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The team and daily-status sections describe extracting response times, behavioral patterns, reporting relationships, blockers, and personnel performance-style indicators without any warning about employee privacy, monitoring sensitivity, or consent. This is particularly dangerous because it enables workplace profiling and inferential analytics on staff behavior, which can have serious privacy, trust, legal, and HR consequences if used without safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code reads email addresses and phone numbers from markdown files, then later persists derived records to disk. While the script has general docstrings and some status prints, it does not clearly disclose to the user that sensitive personal data will be collected and stored in output files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Appending to the ontology file is a file-write operation that stores structured data derived from user notes. Although there is a print after writing, there is no prior disclosure or confirmation that note-derived data will be permanently appended to persistent storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function creates files under the vault and includes names and missing-email indicators derived from personal notes. The write is visible in code, but the script does not clearly warn users beforehand that it will generate additional files containing sensitive relationship and contact insights.
- Content
Static analysis
No suspicious patterns detected.