Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

obsidian-notesmd-cli-command

v1.0.0

Work with Obsidian vaults (plain Markdown notes) and automate via obsidian-cli.

0· 113·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for michael-c-matias/obsidian-cli-notesmd.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "obsidian-notesmd-cli-command" (michael-c-matias/obsidian-cli-notesmd) from ClawHub.
Skill page: https://clawhub.ai/michael-c-matias/obsidian-cli-notesmd
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: obsidian-cli
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install obsidian-cli-notesmd

ClawHub CLI

Package manager switcher

npx clawhub@latest install obsidian-cli-notesmd
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (work with Obsidian vaults via obsidian-cli) matches the declared required binary and the instructions. However, the SKILL.md refers to a macOS-specific config file (~/Library/Application Support/obsidian/obsidian.json) even though the skill metadata does not declare any OS restriction or config paths. This is a minor mismatch in declared requirements vs. runtime guidance.
Instruction Scope
Runtime instructions mostly stay on‑task (search, create, move, delete notes using obsidian-cli). They explicitly instruct reading the user-specific config file to find active vaults, which is relevant to the purpose but is an undeclared file read of a user data path. The instructions also assume Obsidian’s URI handler and macOS paths; there is no guidance for Linux/Windows locations.
Install Mechanism
The install spec uses Homebrew (brew formula yakitrak/yakitrak/obsidian-cli) which will create the obsidian-cli binary. Using Homebrew is normal, but this is a third‑party tap (yakitrak) rather than the core Homebrew repository: moderate risk if you don't trust that tap. No arbitrary downloads or archives are present.
Credentials
The skill declares no environment variables, credentials, or config paths. That is proportionate to its stated purpose (it only needs the obsidian-cli binary). The only runtime data the instructions reference is the user config file (vault locations).
Persistence & Privilege
always:false and no install-time scripts or code files are included. This is an instruction-only skill that relies on an external binary; it does not request persistent elevated privileges or modify other skills' configs.
What to consider before installing
This skill appears to be what it claims (an obsidian-cli helper) but review a few things before installing: 1) The SKILL.md reads ~/Library/Application Support/obsidian/obsidian.json (macOS); if you’re on Linux/Windows or expect cross-platform use, confirm path handling. 2) The Homebrew formula is hosted in a third‑party tap (yakitrak); verify the tap and formula source before brew install to avoid installing untrusted binaries. 3) The skill will read your Obsidian config to find vault paths—these are local user files (not secret keys, but they reveal note locations). If you’re uncomfortable, run obsidian-cli manually first to verify behavior, or inspect the brew formula source. If you can provide the brew formula URL or the formula source repo, I can re-evaluate and raise or lower confidence.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

💎 Clawdis
Binsobsidian-cli

Install

Install obsidian-cli (brew)
Bins: obsidian-cli
brew install yakitrak/yakitrak/obsidian-cli
latestvk97c1e6aj39bc0jgcq8yc727yh8392tf
113downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Obsidian

Obsidian vault = a normal folder on disk.

Vault structure (typical)

  • Notes: *.md (plain text Markdown; edit with any editor)
  • Config: .obsidian/ (workspace + plugin settings; usually don’t touch from scripts)
  • Canvases: *.canvas (JSON)
  • Attachments: whatever folder you chose in Obsidian settings (images/PDFs/etc.)

Find the active vault(s)

Obsidian desktop tracks vaults here (source of truth):

  • ~/Library/Application Support/obsidian/obsidian.json

obsidian-cli resolves vaults from that file; vault name is typically the folder name (path suffix).

Fast “what vault is active / where are the notes?”

  • If you’ve already set a default: obsidian-cli print-default --path-only
  • Otherwise, read ~/Library/Application Support/obsidian/obsidian.json and use the vault entry with "open": true.

Notes

  • Multiple vaults common (iCloud vs ~/Documents, work/personal, etc.). Don’t guess; read config.
  • Avoid writing hardcoded vault paths into scripts; prefer reading the config or using print-default.

obsidian-cli quick start

Pick a default vault (once):

  • obsidian-cli set-default "<vault-folder-name>"
  • obsidian-cli print-default / obsidian-cli print-default --path-only

Search

  • obsidian-cli search "query" (note names)
  • obsidian-cli search-content "query" (inside notes; shows snippets + lines)

Create

  • obsidian-cli create "Folder/New note" --content "..." --open
  • Requires Obsidian URI handler (obsidian://…) working (Obsidian installed).
  • Avoid creating notes under “hidden” dot-folders (e.g. .something/...) via URI; Obsidian may refuse.

Move/rename (safe refactor)

  • obsidian-cli move "old/path/note" "new/path/note"
  • Updates [[wikilinks]] and common Markdown links across the vault (this is the main win vs mv).

Delete

  • obsidian-cli delete "path/note"

Prefer direct edits when appropriate: open the .md file and change it; Obsidian will pick it up.

Comments

Loading comments...