ClawHub
Back to skill

Security audit

Obsidian 快速上手指南

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only Obsidian quick-start guide, with only a minor risk that its broad trigger examples may make it appear during ordinary note-planning requests.

Safe to install as an Obsidian reference skill. Be aware it may surface during general planning or note-taking prompts, and review any third-party Obsidian plugins or Templater JavaScript separately before enabling them in Obsidian.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are broad natural-language requests such as 'Obsidian 怎么用' and common productivity prompts like '帮我规划每日待办'. In an agent environment, these can overlap with ordinary conversation and cause unintended invocation of the skill, which may hijack routing or produce irrelevant actions without explicit user intent.

Static analysis

No suspicious patterns detected.