obclip

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.0

Overview

This is an instruction-only helper for installing and running a page-clipping CLI, with the main risks clearly tied to npm execution and optional browser profile use.

Before installing, verify that you trust the @harris7/obclip npm package and the referenced GitHub skill source. For logged-in sites, use a dedicated browser profile rather than your everyday browser profile so cookies and sessions are limited to the clipping workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest allows implicit invocation and describes activation as "Use $obclip to install or run the obclip CLI and capture a target page into a note," but it does not define clear trigger boundaries, exclusions, or constrained contexts. This creates ambiguity about when the skill should activate versus when similar everyday requests about installing tools, running a CLI, or clipping pages should not invoke it.

VirusTotal

66/66 vendors flagged this skill as clean.