Back to skill
Skillv1.0.0
ClawScan security
obsidian-user-guide · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 7, 2026, 4:43 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only user guide for the official Obsidian CLI and its requested actions and requirements are consistent with that purpose, but it instructs the user/agent to clone an external GitHub repository which you should inspect before running.
- Guidance
- This appears to be a straightforward Obsidian CLI usage guide. Before following the SKILL.md installation steps, especially the git clone, inspect the GitHub repository (https://github.com/kepano/obsidian-skills) to confirm it only contains the SKILL.md files you expect. Prefer copying only the single SKILL.md you trust instead of cloning an entire third‑party repo into ~/.openclaw/workspace/skills/. Be cautious about executing any scripts found in that repo and verify the repo owner and contents if you require a higher assurance level.
Review Dimensions
- Purpose & Capability
- okName/description match the SKILL.md: the document is a CLI guide for Obsidian and the commands and installation steps described are consistent with that purpose.
- Instruction Scope
- okInstructions are limited to installing/enabling Obsidian CLI, running obsidian CLI commands, cloning a skills repo into the OpenClaw skills directory, and restarting the gateway. The SKILL.md does not instruct reading unrelated system files or exporting secrets.
- Install Mechanism
- noteThere is no formal install spec, but the SKILL.md tells users/agents to git clone https://github.com/kepano/obsidian-skills into ~/.openclaw/workspace/skills/. GitHub is a common host, but cloning an external repository into the agent's skills folder will place arbitrary SKILL.md files and possibly other code under the OpenClaw workspace; you should review the repository contents before cloning.
- Credentials
- okThe skill does not request environment variables, credentials, or config paths. All commands shown use the local Obsidian CLI and local file paths, which is proportionate to the described functionality.
- Persistence & Privilege
- okalways is false and model invocation is allowed by default. The SKILL.md asks the user/agent to restart the gateway so the new SKILL.md files are discovered, which is a normal installation step and does not request privileged system-wide changes.