ClawHub
Back to skill

Security audit

大师研究笔记工作流

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for research note-taking, but it asks agents to use private user context and write into an Obsidian vault without enough scoping or confirmation safeguards.

Install only if you are comfortable with an agent using your Obsidian vault and personal context for research notes. Before running it, confirm the exact vault path, require preview-before-write, avoid sharing unrelated private notes with delegated tasks, and replace the shell search example with a safer file-search method.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:57
Finding

Excessive Propagation of Personal Context to Delegated Research Tasks

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–61
Vulnerability Type: Unnecessary collection and distribution of personal information
Risk Level: Medium

Vulnerable Snippet

markdown
#### The supplied context must include
- Basic user information (occupation, location, and existing arrangements)
- The user's existing related notes or knowledge foundation
- The knowledge positioning of previously researched figures

The snippet is an English translation of the corresponding source instructions.

Technical Analysis

The workflow requires the collection of the user's occupation, location, existing arrangements, and related private notes. This information is intended to be included in the context supplied to the parallel delegated research tasks described earlier in the workflow.

These data categories are not universally required to research a public figure. The Skill does not define data-minimization rules, require informed user consent, redact sensitive note content, or restrict each delegate to the minimum context required for its assigned research dimension.

Consequently, personal information can be replicated into as many as six delegated task contexts. This expands the number of components processing the information and violates least-privilege principles for data access.

Attack Path

  1. A user activates the Skill to research a public figure.
  2. The workflow gathers the user's occupation, location, existing arrangements, and related notes.
  3. The collected information is inserted into the context prepared for delegated research tasks.
  4. Up to six delegates receive personal information regardless of whether each task requires it.
  5. A compromised, untrusted, or overly verbose delegate may retain, expose, or reproduce information unrelated to its assigned task.

Impact Assessment

This issue does not directly grant operating-system privileges or demonstrate transmi ...[truncated 405 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make personalization optional and request explicit user consent before reading or distributing private notes.
  2. Do not collect location, occupation, or existing arrangements unless the current research objective specifically requires them.
  3. Construct a separate minimal context for each delegated task rather than sharing a common user profile.
  4. Redact names, locations, account details, financial information, credentials, and unrelated note content before delegation.
  5. Summarize relevant knowledge locally instead of providing delegates with complete note contents.
  6. Document which delegates receive personal information and why.
  7. Prevent delegated tasks from persisting user context or including it in their final outputs unless explicitly requested.
  8. Add a default rule that private vault content must not be sent to remote services without explicit confirmation.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:125
Finding

Unsafe Shell Command Template for Searching the Obsidian Vault

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 125–130
Vulnerability Type: Potential shell command injection through unvalidated path or keyword substitution
Risk Level: Medium

Vulnerable Snippet

markdown
### Phase 3: Associate the Research with Existing User Notes

```bash
ls /path/to/vault/ | grep -i "keyword"

Avoid duplication. Existing content should not be copied again; only refinement and deeper analysis should be performed.

text

The surrounding prose and placeholder are English translations of the source instructions.

### Technical Analysis

The Skill recommends constructing a shell pipeline using a vault path and a search keyword. Both values may ultimately be derived from user input, workspace configuration, or model-generated content, but the instructions do not require validation, fixed argument boundaries, safe escaping, or restriction to an approved vault root.

If an implementation replaces the placeholders through direct string interpolation, shell metacharacters in the path or keyword could terminate the intended argument and introduce additional commands. Quoting the keyword alone is insufficient when substitutions can contain quote characters, command substitutions, or other shell syntax.

The use of `ls` piped to `grep` is also unreliable for filenames containing line breaks or unusual characters and may omit hidden files. The issue is therefore both a potential command-injection flaw and an unsafe filesystem-search practice.

### Attack Path

1. An attacker influences the research keyword, subject name, or configured vault path.
2. The Agent substitutes the attacker-controlled value into the documented shell template.
3. The generated command is passed to a shell as a single command string.
4. Shell metacharacters in the substituted value escape the intended `grep` or path argument.
5. The shell executes an additional attacker-selected command with the Agent's c
...[truncated 759 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the shell pipeline with a filesystem-search API that accepts the root path and query as separate structured parameters.
  2. Resolve and canonicalize the vault path, then verify that it is located beneath a user-approved vault root.
  3. Treat the keyword as data rather than executable syntax; never concatenate it into a shell command.
  4. If a shell is unavoidable, pass dynamic values as positional arguments to a fixed script and quote every expansion.
  5. Prohibit eval, sh -c, and equivalent mechanisms for commands containing user- or model-controlled values.
  6. Validate path and query lengths and reject null bytes or unsupported control characters.
  7. Use a dedicated note-indexing or file-enumeration operation that safely handles hidden files, spaces, newlines, and Unicode filenames.
  8. Run vault-search operations with the minimum necessary filesystem permissions and without network access.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill description, prompts, templates, and example outputs are written in Chinese and prescribe Chinese-form note structures, with no indication that the user may choose another language. This is a natural-language policy concern because it implicitly fixes the interaction/output locale rather than offering opt-in or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill says it applies whenever a user asks to research a person, with examples like '研究马斯克', and even defaults to proceeding when the user provides only '研究XXX' without more detail. This trigger description is broad natural language that could overlap with ordinary conversation, and the file does not provide explicit exclusion conditions or a bounded trigger list.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs writing directly into an Obsidian vault path, which is a local file modification side effect, but it does not require an explicit confirmation or warning before changing user files. In practice, this can lead to unintended overwrites, duplicate notes, or modification of the wrong vault/location, especially because the path is templated and the workflow also encourages checking existing notes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.