Security audit

Obsidian Best Practices

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only Obsidian resource guide; it includes some install and sync commands users should verify before running, but I found no hidden execution, persistence, or exfiltration behavior.

Before following setup commands from this skill, verify external packages and links yourself, prefer pinned versions or official installation channels, avoid sudo/admin shells, and do not pass encryption passwords on the command line when an interactive prompt is available. Back up vaults before trying sync workflows.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/obsidian_features.md:11
Finding: Unpinned Global Installation of a Mutable npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Record and verify the expected package integrity hash or signed provenance before installation. Confirm that the package publisher, repository, release tag, and npm provenance metadata correspond to the official Obsidian project. 3. Prefer an official installation channel that provides signed artifacts, checksums, and reproducible release information. 4. Avoid recommending installation from an administrative or root shell. State explicitly that users must not use `sudo` unless the official platform-specific installation procedure requires it. 5. Where practical, avoid global installation. Use an isolated environment, container, or dedicated unprivileged service account with access only to the intended vault. 6. Review package contents and lifecycle scripts before recommending a new version, including any bundled native binaries. 7. Add a warning that the package is open beta and that users should back up vaults, test with non-sensitive data, and verify the package version before authenticating. 8. Prefer prompting for encryption passwords interactively rather than placing passwords in command-line arguments, because command arguments may be exposed through shell history or process listings. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/obsidian_features.md (reported line 99)May include surrounding context.
ob sync-config [--path ] [options]

text
| Option | Description | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--path` | Local vault path (default: current directory) | | `--mode` | Sync mode: `bidirectional` (default), `pull-only` (only download, ignore local changes), or `mirror-remote` (only download, revert local changes) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/obsidian_features.md (reported line 101)May include surrounding context.
md
| Option | Description | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--path` | Local vault path (default: current directory) | | `--mode` | Sync mode: `bidirectional` (default), `pull-only` (only download, ignore local changes), or `mirror-remote` (only download, revert local changes) | | `--conflict-strategy` | `merge` or `conflict` | | `--file-types` | Attachment types to sync: `image`, `audio`, `video`, `pdf`, `unsupported` (comma-separated, empty to clear) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/obsidian_features.md (reported line 103)May include surrounding context.
md
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--path` | Local vault path (default: current directory) | | `--mode` | Sync mode: `bidirectional` (default), `pull-only` (only download, ignore local changes), or `mirror-remote` (only download, revert local changes) | | `--conflict-strategy` | `merge` or `conflict` | | `--file-types` | Attachment types to sync: `image`, `audio`, `video`, `pdf`, `unsupported` (comma-separated, empty to clear) | | `--configs` | Config categories to sync: `app`, `appearance`, `appearance-data`, `hotkey`, `core-plugin`, `core-plugin-data`, `community-plugin`, `community-plugin-data` (comma-separated, empty to disable config syncing) | | `--excluded-folders` | Folders to exclude (comma-separated, empty to clear) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/obsidian_features.md (reported line 104)May include surrounding context.
md
| `--path` | Local vault path (default: current directory) | | `--mode` | Sync mode: `bidirectional` (default), `pull-only` (only download, ignore local changes), or `mirror-remote` (only download, revert local changes) | | `--conflict-strategy` | `merge` or `conflict` | | `--file-types` | Attachment types to sync: `image`, `audio`, `video`, `pdf`, `unsupported` (comma-separated, empty to clear) | | `--configs` | Config categories to sync: `app`, `appearance`, `appearance-data`, `hotkey`, `core-plugin`, `core-plugin-data`, `community-plugin`, `community-plugin-data` (comma-separated, empty to disable config syncing) | | `--excluded-folders` | Folders to exclude (comma-separated, empty to clear) | | `--device-name` | Device name to identify this client in the sync version history |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/obsidian_features.md (reported line 106)May include surrounding context.
md
| `--conflict-strategy` | `merge` or `conflict` | | `--file-types` | Attachment types to sync: `image`, `audio`, `video`, `pdf`, `unsupported` (comma-separated, empty to clear) | | `--configs` | Config categories to sync: `app`, `appearance`, `appearance-data`, `hotkey`, `core-plugin`, `core-plugin-data`, `community-plugin`, `community-plugin-data` (comma-separated, empty to disable config syncing) | | `--excluded-folders` | Folders to exclude (comma-separated, empty to clear) | | `--device-name` | Device name to identify this client in the sync version history | | `--config-dir` | Config directory name (default: `.obsidian`) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/obsidian_features.md (reported line 107)May include surrounding context.
md
| `--file-types` | Attachment types to sync: `image`, `audio`, `video`, `pdf`, `unsupported` (comma-separated, empty to clear) | | `--configs` | Config categories to sync: `app`, `appearance`, `appearance-data`, `hotkey`, `core-plugin`, `core-plugin-data`, `community-plugin`, `community-plugin-data` (comma-separated, empty to disable config syncing) | | `--excluded-folders` | Folders to exclude (comma-separated, empty to clear) | | `--device-name` | Device name to identify this client in the sync version history | | `--config-dir` | Config directory name (default: `.obsidian`) | ### `ob sync-status`

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/obsidian_features.md (reported line 108)May include surrounding context.
md
| `--configs` | Config categories to sync: `app`, `appearance`, `appearance-data`, `hotkey`, `core-plugin`, `core-plugin-data`, `community-plugin`, `community-plugin-data` (comma-separated, empty to disable config syncing) | | `--excluded-folders` | Folders to exclude (comma-separated, empty to clear) | | `--device-name` | Device name to identify this client in the sync version history | | `--config-dir` | Config directory name (default: `.obsidian`) | ### `ob sync-status`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/obsidian_master_resources.md (reported line 216)May include surrounding context.
md
However, it seems mostly eye candy as far as usefulness. I have gotten into filtering and coloring and that makes it much better, but I still feel there must be more that can be done to tease out the gems of inspiration. Although sometimes beautiful, merely seeing the size of the hair-ball isn’t enough, seeing all those connections isn’t really helpful and poking around is less than efficient (I can only imagine when I have hundreds or thousands of notes in there, which I do intend to). Off the top of my head it seems that a more open ended filtering system (perhaps not unlike data view) applied to the graph would allow a user to see his data and connections in unique ways. I can imagine a yaml variable set as a type of importance, for example, and sorted for, and the graph dot sized accordingly. This is perhaps a simplistic example, but I am searching for some way to see those eureka moments. Obsidian is still pre 1.0 so I’m not being critical. Just the opposite, I think it’s amazing and such an open system where anything is possible. Any insights in this direction would be very appreciated.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger description includes broad phrases like "asks for recommendations" across beginner guides, workflows, and PKM methodologies, but does not define clear boundaries or exclusions. This may cause unintended invocation for general productivity or note-taking discussions that are not specifically about this skill's curated Obsidian resources.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The phrase "asks for guidance on setting up Obsidian, learning how to use it, finding courses, or implementing PKM systems" mixes a specific product scope with broader methodology requests. Without exclusion conditions, the skill could activate for generic PKM-system questions unrelated to Obsidian.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The embedded HTML fallback sets lang="en", which is a natural-language locale constraint present in this file. There is no surrounding explanation that this fallback is region-specific or that users can select another language, so it appears to hard-code English without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.