Obsidian Brain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 1.7.0

Overview

This memory skill is coherent in purpose, but it makes cross-session reading, writing, and even publishing actions too automatic and broadly scoped for routine use.

Install only if you intentionally want an agent to maintain a persistent Obsidian-based memory and you are comfortable reviewing what it saves. Before use, narrow activation to explicit memory requests, require approval before writes and publishing, avoid storing secrets or confidential content, and make retrieved memory advisory rather than mandatory task context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:107
• Finding: Mandatory Global Workflow and Response Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 107–123 and line 140 **Vulnerability Type**: Mandatory instruction, tool-use, and response-format override **Risk Level**: High **Complete Evidence Snippet**: ```markdown ## 执行流程 ``` 0. ⚠️ 读 agent memory（不可跳过，结果可视化） search_files → L0 → 相关则L1 → 注入上下文 **在回复开头必须报告：** `📖 agent memory：读取 N 个碎片 → [标题+summary → 相关/不相关]` 1~N. 执行任务（中途转向时重搜） N+1. ⚠️ 写 agent memory + 📋 留位检查（不可跳过） 三问：决策/结论/发现？踩坑/教训？下次需要？ 任一"是" → 立即写入，同轮次完成。不等不拖。 末尾加 `📋 agent memory：本次是否有需写入碎片？[有/无]` N+2. ⚠️ 如果本技能（obsidian-brain）被编辑 → clawhub publish 新版本 ``` ## 触发约束 - **AGENTS.md**：对话开始强制搜 + 任务结束强制写 - **流程第0步**：任务前必搜，优先于网络/知识库 - **📋 留位**：每次回复末尾检查 - **失效保护**：连续3次漏读/漏写 → 下次加载时回溯 ``` Additional trigger at line 140: ```markdown - **用户发文件名/单字不算"任务开始"** → 任何用户消息（即使只是一个文件名）都是对话开始信号，必须先执行第0步搜碎片。文件名≠跳过符。 ``` ### Technical Analysis The Skill declares persistent-memory search and write operations to be mandatory for every user message, including messages unrelated to memory management. It also states that memory retrieval must take precedence over network and knowledge-base operations and requires fixed content at the beginning and end of every response. These instructions extend beyond the Skill's legitimate, user-requested function. Once loaded, they can alter the current session's execution order, force tool usage, inject stored content into context, and interfere with response formats required by higher-priority tasks. The broad trigger treating every user message as a new memory operation substantially increases the affected scope. ### Attack Path 1. The Skill is loaded in an agent session. 2. A user submits any message, even a filename or single-character input. 3. The Skill treats that message as a mandatory memory-retrieval trigger. 4. The agent searches persistent memory before performing the requested task. 5. Relevant memory fragments are injecte ...[truncated 741 chars]
• Remediation: ## Remediation Suggestions - Restrict activation to explicit user requests to retrieve or store agent memory. - Remove language declaring operations mandatory, non-skippable, or higher priority than the current task. - Do not require fixed prefixes or suffixes in every response. - Ask for user confirmation before accessing memory for a task that does not clearly require it. - Keep retrieved memory isolated from executable instructions and treat it as untrusted reference data. - Permit higher-priority instructions and task-specific output requirements to suppress all optional Skill behavior. - Add a deny-by-default policy for unrelated conversations and narrowly scope searches to the current project.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:82
• Finding: Persistent Cross-Session Memory Poisoning Through Conversation-Derived Fragments## Vulnerability Details **File Location**: `SKILL.md`, lines 82–86, 111–123, and 139; `references/storage-distinction.md`, lines 7–17 and 23–31 **Vulnerability Type**: Unsanitized persistent storage and automatic future retrieval of conversation-derived content **Risk Level**: High **Complete Evidence Snippet from `SKILL.md`**: ```markdown ## 写入 **判断（什么该记）：** 决策/结论/价格数据、踩坑教训、调研发现 ✔ | 临时计算、一次性信息 ✘ **流程：** LLM从结果提取关键事实 → 去重（有相似碎片且度>0.8→合并更新）→ 写 `.md` ``` ```markdown N+1. ⚠️ 写 agent memory + 📋 留位检查（不可跳过） 三问：决策/结论/发现？踩坑/教训？下次需要？ 任一"是" → 立即写入，同轮次完成。不等不拖。 ``` ```markdown - **AGENTS.md**：对话开始强制搜 + 任务结束强制写 - **流程第0步**：任务前必搜，优先于网络/知识库 ``` ```markdown - **混淆 system memory 与 agent memory 碎片** → 两者是独立存储。system memory 用 `memory` 工具操作（2200字符上限），agent memory 碎片用 `write_file` 写 Obsidian vault（无上限）。一个满了不影响另一个，不要用一个判断另一个。 ``` **Complete Evidence Snippet from `references/storage-distinction.md`**: ```markdown | | System Memory (memory tool) | Agent Memory Fragments | |:---|:---|:---| | **Tool** | `memory()` | `write_file()` to Obsidian vault | | **Location** | Hermes internal | `D:\App\Obsidian\RealGhost\agent memory\` | | **Capacity** | ~2,200 chars total | No practical limit (filesystem) | | **Format** | Compact text entries | Full `.md` files with frontmatter | | **Survives reboot** | Yes | Yes | | **User visible** | No (injected as context) | Yes (editable notes in Obsidian) | | **What it stores** | Preferences, environment, user profile | Session decisions, root causes, lesson learned | ``` ```markdown - **System memory**: durable facts about the user/environment that should always be in context. Preferences, tool quirks, project conventions. Keep under 2,200 chars. - **Agent memory fragments**: session-specific findings, root cause analyses, design decisions, rule updates. Not restricted by char limit. ``` ### Technical Analysis The Skill directs the language model to extract fa ...[truncated 2497 chars]
• Remediation: ## Remediation Suggestions - Require explicit user approval before each persistent-memory write. - Store only structured facts in an allowlisted schema rather than unrestricted Markdown bodies. - Reject imperative language, tool directives, role changes, safety-policy changes, and embedded prompt instructions. - Apply secret and personal-data detection before persistence. - Record immutable provenance, author, timestamp, source task, trust level, and user approval status. - Treat every retrieved fragment as untrusted data and prevent it from overriding current or higher-priority instructions. - Scope retrieval to an explicitly selected project and use the minimum necessary fragment set. - Introduce storage quotas, expiration policies, review controls, deletion capabilities, and audit logs. - Separate factual memory from instructions and prohibit stored fragments from initiating tool calls. - Provide a preview of proposed memory content and allow the user to edit or reject it before writing.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:115
• Finding: Automatic Publication of Locally Edited Skill Content## Vulnerability Details **File Location**: `SKILL.md`, line 115 **Vulnerability Type**: Publication without explicit owner authorization or release review **Risk Level**: Medium **Complete Evidence Snippet**: ```markdown N+2. ⚠️ 如果本技能（obsidian-brain）被编辑 → clawhub publish 新版本 ``` ### Technical Analysis The Skill instructs the agent to publish a new version whenever the Skill is edited. The instruction does not require explicit owner confirmation, source review, security testing, change approval, or verification of the destination package. Publication is an externally consequential operation that may use credentials or authorization already available to the agent. Automatically coupling a local edit to publication violates least-privilege and change-control principles. An attacker who can influence the agent into editing the Skill may be able to convert a local modification into a distributed release. ### Attack Path 1. An attacker supplies content that persuades or causes the agent to edit `obsidian-brain`. 2. The agent applies the local modification using its existing file-write permissions. 3. The line-115 instruction treats the edit as an automatic publication trigger. 4. If the environment has authenticated ClawHub publishing access, the agent invokes `clawhub publish`. 5. The unreviewed or attacker-influenced version is distributed to downstream users. ### Impact Assessment Successful exploitation is conditional on the agent having valid publishing credentials and network access. The instruction does not itself obtain those credentials or elevate operating-system privileges. However, it can misuse existing publication authority to distribute unauthorized changes. The affected scope may extend beyond the local system to every user or environment that installs the published version. Potential consequences include supply-chain compromise, propagation of malicious Skill instructions, loss of package integrity, and ...[truncated 42 chars]
• Remediation: ## Remediation Suggestions - Remove the automatic publication instruction from the Skill workflow. - Require explicit, task-specific confirmation from the package owner immediately before publication. - Separate local editing permissions from release credentials. - Use a reviewed release pipeline with authenticated approvals, automated tests, security scans, and signed artifacts. - Display the exact diff, package name, version, and target registry before requesting approval. - Use short-lived, narrowly scoped publication tokens unavailable during ordinary Skill execution. - Maintain immutable release logs and support rapid revocation or rollback of unauthorized versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to extract facts from conversations and write them into persistent Obsidian fragments, but it does not warn about storing sensitive, personal, or confidential information across sessions. This creates a clear retention risk because users may not realize their conversation-derived data is being persisted to disk.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation trigger is extremely broad: it loads for any operation involving cross-session memory, searching the vault, or anything touching the agent memory folder. In practice this can cause the skill to activate during many ordinary interactions, increasing the chance of unnecessary memory access and persistence side effects without clear user intent.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill normalizes cross-session persistence of conversation-derived facts by default and couples it to an automatic extraction-and-write workflow. In a memory skill context this is especially dangerous because the retained content may include sensitive business context, personal data, or secrets that persist and may later be retrieved or disclosed unintentionally.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill requires automatic reading and searching of stored memory at the start of every task, without notifying the user that prior session data may be accessed. This can surface stale or sensitive context unexpectedly and expand data exposure beyond what is necessary for the current task.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The operational instructions and required output strings are written as mandatory Chinese-language response components, such as the required report headers for memory reads and writes. There is no indication that users may choose another language or that the locale restriction is required for a region-specific purpose.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill requires the agent to report retrieved memory fragments at the start of every reply, including titles and summaries. That creates a direct disclosure channel where prior session information may be revealed in plain language even when not needed for the user's present request.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill mandates activation on vaguely defined 'task start' conditions, including effectively any user message, and makes the read/write flow non-optional. That broad mandatory behavior can turn routine interactions into memory retrieval and storage events, which is risky when prior context may be sensitive or unrelated.

Static analysis

No suspicious patterns detected.