graphthulhu

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:28 PM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for managing Logseq or Obsidian notes, but it exposes broad write/delete access through an unpinned third-party executable.

Install only if you trust the graphthulhu publisher and are comfortable giving the MCP server access to your notes or Logseq token. Prefer pinning a specific reviewed version, verifying release integrity if available, backing up your vault or graph first, and requiring explicit approval before delete, move, rename, or bulk update actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned and Unverified Third-Party Executable Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–17
Vulnerability Type: Supply-chain exposure caused by unpinned and unverified executable installation
Risk Level: Medium

Evidence

markdown

## Install

Download the binary for your platform from [GitHub Releases](https://github.com/skridlevsky/graphthulhu/releases) and put it on your PATH.

Or: `go install github.com/skridlevsky/graphthulhu@latest`

Technical Analysis

The installation instructions direct users either to download an executable from a mutable release page or to install the latest Go module version. Neither method pins an audited immutable version, commit, or artifact digest. The instructions also provide no checksum or cryptographic-signature verification procedure.

Consequently, the executable installed at audit time may differ from the implementation reviewed or expected by the user. If the upstream repository, maintainer account, release process, module distribution channel, or published artifact is compromised, a malicious release could be installed without an integrity check detecting the substitution.

This risk is material because the configured executable is intentionally granted access to sensitive knowledge-graph data. The documented Obsidian configuration gives it direct read-write access to a vault, while the Logseq configuration supplies an API endpoint and authentication token. No malicious behavior is established in the reviewed file; the vulnerability is the unsafe dependency acquisition process and resulting supply-chain exposure.

Attack Path

1. An attacker compromises the upstream repository, maintainer credentials, release pipeline, module source, or downloadable release artifact.
2. The attacker publishes a malicious version as the current release or causes @latest to resolve to it.
3. A user follows the documented installation instructions without pinning a version or validating an artifact si ...[truncated 1190 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a specifically audited release version or immutable commit identifier.
2. Publish SHA-256 or stronger cryptographic digests for each platform artifact and require users to verify them before installation.
3. Prefer signed releases and document signature verification against a trusted, independently distributed maintainer key.
4. Record the approved version, commit, expected digest, and verification commands directly in SKILL.md.
5. Use reproducible builds or publish build provenance and software-bill-of-materials attestations where possible.
6. Run the MCP server under a dedicated, least-privileged account or sandbox, restricting filesystem access to the intended vault.
7. Use a narrowly scoped Logseq token when supported, rotate it periodically, and avoid exposing it to unrelated processes.
8. Review and test every dependency update before changing the pinned version or approved artifact digest.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly advertises 'Full read-write support' for an Obsidian vault without any adjacent warning that the agent can modify user notes and potentially cause unintended or irreversible changes. Because this skill targets a personal knowledge base ('your second brain') and exposes broad write operations, users may authorize it without understanding the data integrity risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tool list includes destructive or high-impact actions such as update/delete/move blocks, rename pages with link updates, and bulk update properties, but provides no explicit warning about irreversible modifications or corruption of note structures. In an agent setting, this increases the chance that a user or upstream prompt causes mass unintended edits across a knowledge graph.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.