T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sync.py:190- Finding
Personal Contact Data Stored in a Plaintext Ontology File with Inherited Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Obsidian Ontology Sync 1.0.1
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-aligned, but it continuously centralizes sensitive Obsidian note data into plaintext generated files with limited privacy, permission, and scheduling safeguards.
Review this before installing if your Obsidian vault contains personal, client, employee, financial, or confidential project data. Use a narrow vault path, run dry-run first, avoid enabling cron until outputs are reviewed, restrict filesystem permissions on the ontology and feedback directories, and consider disabling or removing PII extraction if the graph may be backed up, synced, or read by other local users or tools.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README encourages automated periodic processing of personal knowledge base notes, extraction of sensitive properties like email and phone, and storage of derived graph data without any visible privacy, consent, retention, or access-control warning. In this context, the omission is security-relevant because users may schedule unattended sync over highly sensitive personal/work notes and generate secondary data stores that broaden exposure and are easier to query or exfiltrate.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly describes reading from the Obsidian vault and writing ontology, feedback, logs, and potentially modifying source notes, yet it does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: operators cannot easily constrain or review what filesystem access the skill expects, increasing the risk of overbroad file access or unintended writes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is designed to extract sensitive personal and team-management data such as emails, phones, behavioral patterns, reporting lines, blockers, and project assignments into a queryable ontology, but it provides no privacy, retention, or access-control warning. Centralizing this information materially increases exposure, making misuse, overcollection, or unauthorized querying more damaging than leaving the data dispersed in notes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that Obsidian is the primary source and the ontology is derived, which implies one-way flow and source integrity, but later introduces a mode that writes back into Obsidian notes. This inconsistency can mislead users about trust boundaries and data flow, causing them to enable automation without realizing machine-generated ontology inferences may alter their primary records.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation promises append-only ontology writes during extraction, which suggests safer, auditable behavior, but elsewhere describes updating existing state and modifying source notes. Contradictory guarantees about mutability undermine operator expectations and may lead to unsafe deployment assumptions, especially for scheduled automation handling sensitive notes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs users to install cron jobs that repeatedly scan notes and generate outputs, but it does not clearly warn that this creates ongoing background collection and writing behavior. Continuous unattended processing increases the chance of privacy leakage, stale or incorrect inferences propagating, and unnoticed file modifications or reports accumulating sensitive summaries.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest promises bidirectional synchronization between Obsidian notes and the ontology, but this script only extracts data from markdown into an ontology file and never updates source notes from ontology state. The feedback feature writes separate suggestion files, which is not actual reverse synchronization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically extracts personal contact data such as email addresses and phone numbers from markdown notes and persists them into an ontology store without any consent prompt, minimization, retention control, or sensitivity warning. In this skill context, the vault appears to contain real PKM/contact information under /root/life/pkm, so centralizing PII into a machine-queryable graph increases exposure if the graph is read by other tools, backed up, or leaked.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The description suggests a general markdown-to-ontology extractor, but the code only recognizes a small set of patterns such as 'Email:', 'Phone:', 'Company:', wiki links, and a hard-coded allowlist of project names. This is a materially narrower behavior than the broad capability implied by the manifest.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The feedback action creates directories and writes a dated feedback file into the vault, but the method provides no advance disclosure beyond printing after the write completes. For code files, file writes that affect user data should have some visible warning, confirmation, or documented notice before execution.
- Content