Kg Note Method Obsidian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 3.23.0

Overview

The skill is a disclosed Obsidian note organizer, but it can directly modify, rename, delete, and enrich vault notes without consistent user confirmation.

Review before installing. Use the explicit kg 检查 flow for a preview, keep backups of the Obsidian vault, restrict the working path to the intended vault, and avoid direct execution or web enrichment unless you are comfortable with the agent changing files and contacting external URLs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a strong mismatch between the declared description and the actual code. The description promises substantial Obsidian knowledge-management automation over a note library, but the supplied script only generates two checklist outputs from CLI inputs and optionally writes them to disk. It does not inspect, modify, reorganize, link, deduplicate, or analyze notes in the vault. Its only filesystem interaction is creating/saving checklist markdown files in a _working directory, which is materially different from the claimed primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个面向 Obsidian KG 笔记体系的综合整理/治理工具，强调自动纠错、建关系、去重、补缺等库级能力；但代码只完成非常窄的一项功能：把外部补充资料格式化后追加到单个 Markdown 文件末尾。虽然其中包含简单的按行去重逻辑，可算与“去重”部分略有关联，但远不足以支撑整体声明。代码没有扫描笔记库、没有处理四种笔记类型体系、没有链接权限/命名规范/新旧分离等逻辑，因此描述与实际行为存在明显且实质性的能力不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code does not implement the broad organizational and automation capabilities described. Instead, it performs narrow static validation of YAML frontmatter and note body presence for a single Markdown file passed on the command line. While some validation rules loosely relate to the described note methodology (e.g., note types, link restrictions, metadata conventions), there is no code for automatically correcting notes, creating relationships, deduplicating content, filling missing knowledge, separating irrelevant material, or managing layered loading/new-old separation across an Obsidian vault. Thus the actual behavior is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs use of file reads, file writes, moves, deletions, environment variables, and script execution, but it declares no explicit tool scope or permission boundary. That makes the skill over-privileged by default and prevents policy enforcement around destructive filesystem operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill auto-triggers on broad conditions such as messages beginning with 'kg' or paths containing 'vault', which is ambiguous and easy to activate unintentionally. Because the skill includes write, move, and delete instructions, overly broad activation raises the chance of unintended destructive operations on user files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly allows direct execution mode for note modification without asking the user for confirmation. In a filesystem-writing skill that also performs rename, delete, patch, and cleanup steps, missing confirmation materially increases the risk of accidental data loss or unauthorized modification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

HTTP status checking of embedded images gives the skill unnecessary network reach for its stated purpose and may contact attacker-specified URLs. In a note vault context, that can disclose access patterns, probe internal resources if local URLs are present, and broaden the attack surface beyond local file management.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A note-organization skill instructing network-based image validation expands its trust boundary from local vault management to arbitrary external requests. This can leak sensitive note-derived URLs, create unintended outbound traffic, and introduce SSRF-like behavior if embedded image targets are attacker-controlled.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs web searching and appending externally researched content into notes, which is outside the narrow purpose of local vault organization. This creates data provenance, prompt-injection, and content-integrity risks because untrusted external material may be incorporated into user files automatically.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Web search and enrichment are unjustified for a vault-organization skill and introduce untrusted external inputs into note content. In this context, the danger is higher because the skill also permits direct file modification, allowing externally influenced data to be written into the knowledge base without strong review barriers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown states that the checklist generator automatically appends a step to delete two checklist files, which is a destructive action affecting user data. The description does not include any warning, caution, or explicit notice about this deletion behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring says it will generate and, when configured, save both an 'execution checklist' and a 'status checklist' file. In reality, generate() returns the execution markdown plus a bitmask string, and save_to_file() writes that raw bitmask to the '_检查清单.md' file rather than a structured checklist document, so the described behavior does not match the implemented output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The docstring instructs users to pass Chinese note names and step examples such as '苏州' and '内容检查拆分', which indicates a fixed language expectation. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring explicitly states the program prints '=== EXECUTION LIST ===' and '=== CHECK LIST ===' sections and saves checklist files, implying both sections are checklist content. However, lines 74-79 print the execution checklist and then the bitmask returned from generate(), so the inline documentation actively misdescribes what the second section contains.

Content

No source excerpt is available for this finding.

Tainted flow: 'exec_path' from os.environ.get (line 49, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/checklist-generator.py (reported line 52)May include surrounding context.

python

exec_path = os.path.join(WORKING, f"{safe}_执行清单.md")
    check_path = os.path.join(WORKING, f"{safe}_检查清单.md")

    with open(exec_path, 'w', encoding='utf-8') as f:
        f.write(exec_list)
    with open(check_path, 'w', encoding='utf-8') as f:
        f.write(check_list)

Tainted flow: 'check_path' from os.environ.get (line 50, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/checklist-generator.py (reported line 54)May include surrounding context.

python

with open(exec_path, 'w', encoding='utf-8') as f:
        f.write(exec_list)
    with open(check_path, 'w', encoding='utf-8') as f:
        f.write(check_list)

    return exec_path, check_path

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The runtime usage text tells users the first argument should be a Chinese example like '苏州' and appends a Chinese cleanup step, again implying a mandatory locale. Because the file does not offer a language choice or explain a region-specific requirement, this conflicts with the language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing docstring, usage text, and output description are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale. Under the policy, language constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill documentation uses Chinese for operational descriptions and instructions, with no indication that users may choose another language or that the locale restriction is intentional for a region-specific audience. This can violate a language or locale policy requiring user choice or explicit justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.