arxiv-to-obsidian

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:42 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: fetches public arXiv paper metadata, translates it, and writes a table into a configured Obsidian note.

Before installing, configure the Obsidian vault and folder carefully, run DRY_RUN=1 first, and remember that paper metadata is sent through the local Claude CLI and then written into your Obsidian vault. Use only RSS sources you trust, because generated note content is not strongly sanitized.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/translator.py:54

Finding

Indirect Prompt Injection Through Untrusted arXiv Metadata

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/translator.py:80

Finding

Insufficient Validation and Markdown Sanitization of Externally Derived Content

Content

View full analysis

') abstract = abstract.replace('\n', '
') row = f"| {title} | {abstract} | {link} | {published} |" rows.append(row) return header + "\n" + "\n".join(rows) ``` The externally supplied link is originally accepted without scheme or host validation: ```python link_elem = item.find('link') if link_elem is not None and link_elem.text: paper['link'] = link_elem.text.strip() ``` ### Technical Analysis The translator locates the first apparent JSON array in the Claude response and accepts its elements with limited structural checking. It does not enforce a strict schem ...[truncated 2126 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

bash

obsidian help
claude -p "只输出 ok"
python3 --version
curl --version

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

描述中的核心用途是抓取 arXiv 最新 AI 论文并同步到 Obsidian 今日笔记，而给出的代码片段并不执行网络抓取、RSS 读取、论文筛选、日报组装到笔记系统或任何文件写入操作。它的实际职责更像是一个子组件：把已提供的论文元数据翻译成中文并渲染为 Markdown 表格。虽然这可能是整体技能流程中的支持步骤，但就该代码片段本身而言，其主要行为与声明的主要用途存在明显差异，尤其缺失了声明中最关键的 arXiv 获取与 Obsidian 写入能力，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/fetch-arxiv.sh (reported line 32)May include surrounding context.

sh

echo "Dry Run: $DRY_RUN"
echo ""

require_command curl
require_command python3
require_command claude
require_command obsidian

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description states that it translates titles and abstracts into Simplified Chinese as a fixed behavior. This is a natural-language locale policy concern because the README does not present language selection, opt-in, or justification for forcing a specific output language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The feature list says the skill will translate titles and abstracts into Simplified Chinese, again presenting a fixed locale behavior rather than a user-selected option. Because this is a README instruction affecting user-visible output, it falls under the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill explicitly instructs use of shell-capable commands such as obsidian and local scripts, but it declares no tool scope or allowed-tools boundary. That creates an over-privileged execution path where an agent may invoke broader shell functionality than necessary, increasing the risk of unintended command execution or misuse of local resources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad and ambiguous, so the skill may activate in contexts where the user did not clearly intend network retrieval, translation, or note modification. In a skill that can append or create Obsidian notes, accidental invocation can cause unintended data changes and over-collection of external content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is designed to append to or create notes in the user's Obsidian vault but does not clearly surface that it will modify persistent user data. This can lead to silent or unexpected changes to notes, which is especially risky when combined with automatic target-path conventions and broad triggering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L08 要求“翻译成中文”，L17 进一步明确为“翻译成简体中文”，这是对输出语言的强制性要求。文档中未说明可根据用户偏好保留原文或选择其他语言，因此存在语言/locale 强制策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file description states it translates arXiv metadata to Chinese, and the implementation reinforces this with default target language and Chinese-only translation instructions. This imposes a specific language/locale behavior without any user opt-in or documented justification for the constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/translator.py (reported line 31)May include surrounding context.

python

Respond ONLY with the translation, nothing else."""

    try:
        result = subprocess.run(
            ["claude", "-p", prompt, "--tools", ""],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a workflow around retrieving arXiv AI papers, summarizing them, and syncing them into Obsidian notes. This file instead depends on spawning an external claude command, which introduces a general subprocess-execution capability that is broader and more powerful than the stated paper-to-Obsidian purpose requires.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/translator.py (reported line 73)May include surrounding context.

python

}}
]"""

    result = subprocess.run(
        ["claude", "-p", prompt, "--tools", ""],
        capture_output=True,
        text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends paper titles and abstracts to an external Claude CLI without any disclosure, consent, or local-only alternative. Even though arXiv metadata is usually public, silent exfiltration to a third-party service can violate user expectations, policy boundaries, or future use with non-public content if the script is reused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.