Obsidian Search
v1.0.8Semantic search for Obsidian notes using AI vector embeddings. Find notes by meaning, discover connections, filter by tags/dates/folders, and retrieve full c...
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name, description, and runtime instructions all describe AI semantic search over Obsidian notes using a remote service (Obvec). The listed tools (search_notes, list_notes, get_note, analyze_connections) match the claimed capabilities. Nothing in the SKILL.md asks for unrelated functionality.
Instruction Scope
The instructions are scoped to searching/listing/retrieving/analyzing notes via an MCP link (connector). They explicitly state that note content is uploaded to the Obvec server and that the MCP URL contains an embedded token. The SKILL.md does not instruct reading local system files or unrelated credentials, but it does require sending full note contents to a third party — a material privacy action the user should understand.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill itself. That minimizes install-time risk.
Credentials
No environment variables or platform credentials are declared, which is consistent because access is provided by pasting an MCP link into a Connector. The MCP link acts as the credential (embedded token). That credential grants read access to full note content — reasonable for this feature but high-sensitivity from a privacy perspective. The SKILL.md also asks users to sign up with Google (for the Obvec service), which may link your Google account to the service.
Persistence & Privilege
always:false and no install hooks are present. The skill can be invoked autonomously (platform default), which is expected; note that autonomous invocation + access to your indexed notes means the agent can retrieve/upload note content when allowed by your connector configuration.
Assessment
This skill appears to do what it says, but it requires sending your Obsidian notes (text and embeddings) to a third‑party service (Obvec) via an MCP link that contains an embedded token. Before enabling:
- Confirm you trust the service/domain (obsidian.10xboost.org / rag.10xboost.org) and review its privacy policy and data deletion procedures. The SKILL.md claims storage on Google Cloud and per-user isolation but you should verify.
- Understand that the MCP link is effectively a password: keep it private, and revoke/regenerate it if leaked. The token provides read access to full note content.
- Avoid indexing extremely sensitive data if you cannot accept third‑party storage. Use local-only alternatives if you need stronger privacy guarantees.
- When configuring the Connector, verify which permissions the token grants (SKILL.md says read-only) and that the connector implementation does not add broader access.
- Because this is an instruction-only skill (no code to inspect), consider testing with a small non-sensitive subset of notes first and confirm you can delete indexed data from the Obvec dashboard.
If you want greater assurance, ask the publisher for details (service SLA, where data is stored, retention policy) or prefer a local-only semantic search solution.Like a lobster shell, security has layers — review code before you run it.
Runtime requirements
🔍 Clawdis
latest
Obsidian Search
AI-powered semantic search for your Obsidian notes — find notes by meaning, not just keywords. Powered by Obvec.
Security & Data Handling
- MCP link is a credential: Your MCP Server URL (
https://rag.10xboost.org/mcp?token=xxxxx) contains an embedded authentication token. Treat it like a password — do not share it publicly. - Token scope: The token grants read-only access. It can search, list, retrieve note content, and analyze connections. It cannot modify, delete, or create notes in your Obsidian vault.
- Token lifetime: Tokens are valid for 30 days. After expiry, you will need to get a new MCP link from obsidian.10xboost.org. You can also regenerate the token at any time in Settings, which invalidates any previously shared links.
- Where the token is stored: The token is generated server-side by Obvec. When you paste the MCP link into a Claude Connector or MCP client config, that client stores the link locally on your device. Revoking or regenerating the token server-side invalidates all copies.
- Your note data: To provide semantic search, your Obsidian note content is uploaded to the Obvec server and stored as text and vector embeddings. This means your note content is stored on a third-party server (Obvec, hosted on Google Cloud). Notes are isolated per user and are not shared with other users or used for model training. You can delete your indexed data at any time from your account dashboard.
- No additional credentials: No separate API keys, environment variables, or secrets are needed beyond the MCP link.
Prerequisites
- Sign up at obsidian.10xboost.org with Google
- Connect your Obsidian vault — follow the setup guide to sync your notes
- Get your MCP link: Go to Settings → copy your MCP Server URL
- Add to Claude: Paste the MCP link as a Connector — no install, no API key needed
Available Tools (4)
| Tool | Description |
|---|---|
search_notes | Semantic search — find notes by meaning with similarity scoring, tag/date filters |
list_notes | Browse notes by folder, tags, date range, with sorting options |
get_note | Retrieve full content of a specific note by path or search term |
analyze_connections | Discover related notes through AI-powered similarity analysis |
Workflow
Step 1: Understand the User's Intent
| User Request | Tool to Use |
|---|---|
| "Find notes about X" | search_notes |
| "What did I write about X?" | search_notes |
| "Show my recent notes" | list_notes with sortBy: "modifiedAt" |
| "Notes in folder X" | list_notes with pathPrefix |
| "Open note X" | get_note |
| "What's related to X?" | analyze_connections |
Step 2: Search Notes
Semantic Search
search_notes(
query: "machine learning project ideas",
limit: 10,
minScore: 0.7
)
With Filters
search_notes(
query: "meeting notes",
tags: ["work", "project-x"],
sortBy: "modifiedAt",
limit: 20
)
Step 3: Retrieve Full Content
get_note(path: "Projects/AI Research.md")
or search by term:
get_note(searchTerm: "quarterly review")
Step 4: Discover Connections
analyze_connections(
reference: "Projects/AI Research.md",
limit: 10,
minScore: 0.6
)
Returns notes most semantically similar to the reference — great for finding related ideas, building knowledge graphs, or discovering forgotten notes.
Step 5: Present Results
- Search results: Show titles, relevance scores, and brief excerpts
- Note content: Display the full markdown content
- Connections: Present as a ranked list with similarity scores and note titles
Error Handling
| Error | Solution |
|---|---|
| No results found | Try a broader query or lower minScore |
| Note not found | Use list_notes to find the correct path |
| Token expired | Get a new MCP link from obsidian.10xboost.org Settings (tokens last 30 days) |
Comments
Loading comments...
