Security audit

Obsidian Folder Sync

Security checks for vulnerabilities and agentic risk

Overview

This is a real Obsidian markdown sync skill, but it should be reviewed carefully because it can copy sensitive agent folders and has path handling that can write outside the intended Vault.

Install only if you are comfortable with a tool that can copy Markdown from arbitrary local folders, including agent skills or memory, into an Obsidian Vault. Before running it, manually verify the source path, Vault path, and destination subdirectory, avoid syncing secret-bearing folders, and do not pass untrusted destination names until the path traversal and temporary-directory handling are hardened.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sync.sh:55
Finding: Destination Path Traversal Allows Writes Outside the Obsidian Vault
Content: View full analysis
/dev/null ``` ### Technical Analysis The optional `DEST_SUBDIR` argument is concatenated directly with the supplied Vault path. The script does not reject absolute paths or `..` path components, canonicalize the resulting destination, or verify that the resolved destination remains beneath the canonical Vault directory. For example, a value such as `../../outside` causes `DEST_DIR` to resolve outside the intended Vault. Existing symbolic links in destination path components may similarly redirect the write operation outside the Vault boundary. Although the values are shell-quoted and therefore do not provide shell command injection, quoting does not prevent filesystem path traversal. ### Attack Path 1. An attacker obtains influence over the third argument passed to `sync.sh`, such as through an automated agent request or a wrapper that forwards untrusted destination names. 2. The attacker supplies a traversal value: ```bash bash scripts/sync.sh /path/to/source /home/user/Vault ../../target ``` 3. The script constructs: ```text /home/user/Vault/../../target ...[truncated 890 chars]
Remediation: View remediation
&2 exit 1 ;; ..|../*|*/../*|*/..) echo "Error: destination subdirectory cannot contain '..'" >&2 exit 1 ;; esac VAULT_REAL="$(cd "$OBSIDIAN_VAULT" && pwd -P)" mkdir -p -- "$VAULT_REAL/$DEST_SUBDIR" DEST_REAL="$(cd "$VAULT_REAL/$DEST_SUBDIR" && pwd -P)" case "$DEST_REAL" in "$VAULT_REAL"|"$VAULT_REAL"/*) ;; *) echo "Error: destination escapes the Obsidian Vault" >&2 exit 1 ;; esac ``` If symlink traversal is unacceptable, additionally inspect each destination component or create directories using a mechanism that refuses symlink components. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/sync.sh:14
Finding: Predictable Temporary Directory Enables Local Symlink and Race Attacks
Content: View full analysis
/dev/null | sed "s|^$SOURCE_DIR/||" > "$TMP_DIR/files.txt" FILE_COUNT=$(wc -l < "$TMP_DIR/files.txt" | tr -d ' ') ``` The file is consumed by `rsync` and the directory is later recursively removed: ```bash rsync -av --files-from="$TMP_DIR/files.txt" \ --include='*' --exclude='*' \ "$SOURCE_DIR/" "$DEST_DIR/" 2>/dev/null rm -rf "$TMP_DIR" ``` ### Technical Analysis The temporary directory name consists of a fixed prefix and the process ID. Process IDs are observable or predictable on multi-user systems. `mkdir -p` does not fail when an attacker has already created the directory, and the script does not verify the directory's ownership, permissions, or file type. A local attacker can pre-create the expected directory and place a symbolic link named `files.txt` inside it. Shell redirection follows that symlink, allowing the script to truncate and replace another file writable by the victim. An attacker with access to the pre-created directory may also race modifications to `files.txt` before `rsync` consumes it, influencing the source-relative paths selected for synchronization. The recursive cleanup also operates on an attacker-predictable path. While `rm -rf` normally removes a symlink itself rather than traversing ...[truncated 1629 chars]
Remediation: View remediation
&2 exit 1 } cleanup() { rm -rf -- "$TMP_DIR" } trap cleanup EXIT HUP INT TERM ``` Additional hardening measures: - Do not use PID-only names for temporary files or directories. - Do not use `mkdir -p` for security-sensitive temporary workspaces. - Ensure temporary creation fails closed. - Keep the temporary list file inside the securely created directory. - Remove the manual cleanup calls once the `trap` is installed, preventing temporary artifacts from remaining after errors caused by `set -e`. - Where supported, use NUL-delimited file lists (`find -print0` and `rsync --from0`) to handle filenames containing newlines safely. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrases are broad enough to match common backup or sync requests across many folders, including sensitive agent workspaces like skills and memory. In this context, that increases the chance the skill is invoked on high-value directories without strong scope confirmation, leading to unintended data replication into an Obsidian Vault.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The usage instructions describe the command but do not clearly warn that it performs write operations into the target Vault and may copy large amounts of markdown content from arbitrary folders. Because the skill explicitly supports syncing agent workspaces, missing a write-side warning makes accidental data exposure or destructive organizational changes more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's description, usage text, and runtime messages are presented in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. This matches the policy category for language or locale constraints expressed in natural language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.