obsidian-curator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:54 PM UTC
• Version: 0.1.1

Overview

The skill has a coherent Obsidian-vault purpose, but it under-discloses cloud AI data sharing and installs an unpinned npm executable that will access sensitive vault data.

Install only if you are comfortable giving this npm CLI plaintext read/write access to your LiveSync CouchDB vault. Use the local or none AI provider for sensitive vaults unless the documentation clearly states what note content is sent to cloud providers, and prefer a pinned, reviewed package version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Unpinned Third-Party npm Executable Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8–14 **Vulnerability Type**: Unpinned executable dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: emoji: "📋" requires: bins: ["obsidian-curator"] install: - id: node kind: node package: obsidian-curator bins: ["obsidian-curator"] label: "Install obsidian-curator (npm)" ``` ### Technical Analysis The Skill directs the installation system to obtain and install the `obsidian-curator` executable package from npm without specifying an exact version, package integrity digest, or immutable artifact reference. Consequently, the executable installed when the Skill is used may differ from the version that was reviewed. The repository contains only `SKILL.md`; it does not include the package source, a package lockfile, or other artifacts that would allow the installed implementation and transitive dependency graph to be independently audited. The document asserts that the npm package has Sigstore provenance and no lifecycle scripts, but it does not enforce provenance verification or package integrity during installation. Provenance by itself identifies the build source and process; it does not guarantee that every future release is safe or compatible with the audited behavior. ### Attack Path 1. An attacker compromises the npm publisher account, release workflow, source repository, or another component of the package supply chain. 2. The attacker publishes a malicious or compromised release under the legitimate `obsidian-curator` package name. 3. Because the Skill does not pin a version or integrity digest, a subsequent installation resolves to the compromised release. 4. The user or agent invokes the installed `obsidian-curator` executable. 5. The malicious package executes with the invoking user's operating-system privileges. 6. It can attempt to read the local Curator configuration, acces ...[truncated 673 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `obsidian-curator` to an exact reviewed version rather than resolving the latest available release. 2. Pin and verify the npm artifact's integrity digest during installation. 3. Enforce Sigstore provenance verification instead of relying only on a documentation claim. 4. Include the reviewed package source, manifest, and lockfile in the audit scope. 5. Review and lock all transitive dependencies. 6. Configure automated dependency monitoring, but require security review before updating the pinned version. 7. Install and run the CLI with a dedicated, least-privileged operating-system account. 8. Provide CouchDB credentials restricted to only the required database and operations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Cloud AI Features Contradict the Unconditional Local-Network Privacy Claim<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29 and 129–137 **Vulnerability Type**: Misleading data-egress and privacy documentation **Risk Level**: Medium ### Vulnerable Code ```markdown - **Local network only:** Connects to your CouchDB instance (user-configured host/port). No external telemetry, no phone-home, no data leaves your network - **Credentials:** Stored locally in `~/.obsidian-curator/config.json` — never transmitted except to your own CouchDB ``` ```markdown ## AI Providers | Provider | Cost | Privacy | Setup | |----------|------|---------|-------| | `none` | Free | Local | Default — rule-based features only | | `ollama` | Free | Local | `config set ai.provider ollama` + model name | | `openai` | Pay-per-use | Cloud | `config set ai.provider openai` + API key | | `anthropic` | Pay-per-use | Cloud | `config set ai.provider anthropic` + API key | | Custom/OpenRouter | Varies | Varies | Use `openai` provider with custom `baseUrl` | ``` ### Technical Analysis The statement that “no data leaves your network” is unconditional, but the Skill explicitly supports OpenAI, Anthropic, OpenRouter, and custom cloud endpoints. AI-backed operations enrich and file vault notes, so their intended operation requires sending request data derived from those notes to the configured AI provider. A custom `baseUrl` also allows the destination to be an arbitrary service selected through configuration. The documentation does not describe which note content or metadata is transmitted, whether sensitive fields are redacted, or whether users receive a confirmation before cloud processing begins. This inconsistency can cause users to enable cloud processing under the incorrect assumption that all vault data remains local. The issue is especially material because LiveSync encryption must be disabled for this tool, allowing the CLI to read plaintext vault documents before processing them. ### Attack Path 1. A user relies on the statement that ...[truncated 1235 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the unconditional privacy claim with provider-specific language: - `none` and a locally hosted Ollama instance can remain local. - OpenAI, Anthropic, OpenRouter, and remotely hosted custom endpoints cause data egress. 2. Document exactly which note fields, metadata, prompts, and identifiers are transmitted for every AI-assisted command. 3. Require explicit, informed confirmation before enabling or first using a cloud AI provider. 4. Display the destination hostname and a data-egress warning before processing vault documents. 5. Treat custom `baseUrl` values as untrusted and require HTTPS except for explicitly approved loopback or private-network deployments. 6. Consider an endpoint allowlist or provide an administrative policy that disables arbitrary custom endpoints. 7. Add configurable redaction or exclusion rules for sensitive folders, tags, frontmatter fields, credentials, and personal information. 8. Use data-minimizing prompts and avoid submitting complete notes when smaller excerpts are sufficient. 9. Clearly document provider retention, training, and privacy implications. 10. Ensure API keys and CouchDB credentials are stored with restrictive filesystem permissions and never included in AI request bodies or logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill prominently claims that data stays on the local network, but later documents OpenAI and Anthropic cloud providers without an equally explicit warning that note contents may be transmitted to third-party services for processing. In a note-management tool, users may process sensitive personal or organizational content, so this omission can mislead users about privacy boundaries and cause unintended external disclosure.

Static analysis

No suspicious patterns detected.