obsidian-user-guide

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:47 AM UTC
• Version: 1.0.0

Overview

This Obsidian skill is mostly a normal CLI guide, but its install instructions and permanent delete examples create risks users should review before installing.

Install only if you are comfortable with this skill operating on your Obsidian vault. Review the upstream repository and pin a trusted commit before cloning it into OpenClaw's skills directory, and require explicit confirmation before any move, delete, or permanent-delete operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:147
• Finding: Unpinned Remote Skill Repository Installed into an Auto-Discovered Directory## Vulnerability Details **File Location**: `SKILL.md`, lines 147-159 **Vulnerability Type**: Unverified and mutable third-party Skill dependency **Risk Level**: Medium ### Vulnerable Code ```bash # Clone the complete repository into the skills directory git clone https://github.com/kepano/obsidian-skills.git ~/.openclaw/workspace/skills/obsidian-skills ``` ```text The complete repository must be cloned. The expected directory structure is: ~/.openclaw/workspace/skills/obsidian-skills/skills/<skill-name>/SKILL.md OpenClaw automatically discovers all SKILL.md files under ~/.openclaw/workspace/skills/. ``` ### Technical Analysis The documented installation procedure clones the current default branch of a remote repository without pinning a reviewed commit or signed release and without verifying a checksum or cryptographic signature. It places the entire repository directly inside OpenClaw's Skill discovery directory. Consequently, the effective installed content is mutable and is not limited to the project file reviewed in this audit. A compromise of the upstream repository or maintainer account, or an unsafe future upstream revision, could introduce attacker-controlled Skill instructions. Because OpenClaw automatically discovers `SKILL.md` files in the destination hierarchy, such instructions may become available to the agent after installation and restart. This is classified as an insecure dependency rather than confirmed malicious payload retrieval: the reviewed command only clones content, and the audited project contains no evidence that fetched code is automatically executed. The risk arises from trusting unpinned remote components in an auto-discovered instruction location. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the repository's mutable default branch. 2. The attacker adds or modifies one or more `SKILL.md` files with unsafe or instruction-hijacking ...[truncated 1199 chars]
• Remediation: ## Remediation Suggestions 1. Pin installation to a specific, previously reviewed commit hash or cryptographically signed release rather than cloning a mutable default branch. 2. Publish and verify a trusted checksum or signature for the exact archive or commit being installed. 3. Download or clone the repository into a staging directory outside `~/.openclaw/workspace/skills/`. 4. Review the complete pinned revision before installation, including every discovered `SKILL.md`, script, symlink, and configuration file. 5. Copy only explicitly approved Skill directories into OpenClaw's discovery path instead of installing the complete repository. 6. Disable or restrict automatic Skill discovery where possible and require explicit allowlisting. 7. Run OpenClaw with least privilege and limit the filesystem, credential, network, and tool access available to third-party Skills. 8. Document a controlled update process that repeats signature verification and security review before changing the pinned revision.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

obsidian read file=笔记名         # 读取笔记（支持 wikilink 解析）
obsidian read path="文件夹/笔记.md"  # 按路径读取

obsidian create name=新笔记 content="内容"   # 创建笔记

obsidian open file=笔记名          # 在 Obsidian 中打开
obsidian open file=笔记名 newtab  # 在新标签页打开

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents destructive operations, including permanent deletion, but provides no warning about irreversible data loss, no recommendation for confirmation, and no safety guidance for agents before executing them. In an agent context, exposing a permanent-delete command without guardrails increases the risk of accidental or overly broad deletion of user notes.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The file forces a specific language for user-facing instructions throughout the skill documentation, and there is no opt-in, alternative language, or justification that the skill is region-specific. This matches the policy-violation category for language or locale restrictions without user choice.