ClawHub
Back to skill

Security audit

obsidian

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Obsidian helper that uses a disclosed CLI to search, create, edit, move, and delete local Markdown notes.

Install only if you are comfortable giving an agent CLI-level access to your Obsidian vault. Before delete or move/rename operations, confirm the active vault path and exact note path, and consider backing up or using version control for important vaults.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill documents a delete command for notes without any warning about permanence, scope, or the need for user confirmation. In an automation context, an agent could invoke this operation on the wrong vault or note path and cause unintended data loss, especially because Obsidian vaults are normal folders on disk and the command appears to act directly on files.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The move/rename command is described as 'safe refactor' and notes that it updates wikilinks and Markdown links across the vault, but it does not warn that this can trigger broad multi-file modifications. In an agentic or scripted setting, a mistaken target path or ambiguous note name could silently rewrite many files, causing unintended content changes and making recovery harder.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.