Security audit

Gbrain Obsidian Vault

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Obsidian setup helper for OpenClaw/gbrain memory, with no evidence of upload, credential theft, or hidden destructive behavior.

Install only if you want your local ~/wiki vault connected to OpenClaw/gbrain memory. Before running scripts/setup-vault.sh, review it and consider backing up ~/wiki/.obsidian/app.json and core-plugins.json because the script overwrites those files. Also confirm that linking ~/.openclaw/workspace/memory into ~/wiki is acceptable for your privacy and git workflow.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The README explicitly instructs users to run a setup script that rewires their Obsidian vault using symlinks and configuration changes, but it does not clearly warn that this will modify filesystem state in the user's home directory. While this is likely normal installation behavior for the skill, the lack of an explicit safety notice reduces informed consent and increases the chance of accidental data exposure, broken paths, or unintended edits if users run the command without reviewing the script.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases include broad, common language such as '第二大脑可视化', 'memory图谱', and 'second brain vault', which can match many benign note-taking or knowledge-management requests outside this skill's intended scope. Over-broad activation can cause the agent to load and act on this skill in unrelated contexts, increasing the chance of unintended filesystem guidance or repository-modifying recommendations.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The load conditions are functionally ambiguous: requests about '第二大脑可视化' or viewing agent-written memory in Obsidian are not sufficiently constrained to a verified local environment or explicit user intent to modify vault, symlink, gitignore, or export behavior. In practice, this can make the skill activate too often and steer the agent toward sensitive local-path and repo operations in contexts where the user only asked for general conceptual help.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation states that DB writes automatically create or overwrite markdown files in `~/wiki` and that another component will git-commit them on a cron, but it does not clearly warn users that enabling this workflow causes automatic local file modification and version-control actions. In an agent skill context, hidden or underemphasized data-modifying behavior increases the risk of unintended persistence, silent content changes, and accidental publication of sensitive notes through commits.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script unconditionally rewrites .obsidian/app.json and .obsidian/core-plugins.json in the target vault, replacing any existing user configuration without backup, merge, or confirmation. In this skill context, that can silently alter editor behavior and plugin settings for a real knowledge base, causing loss of local preferences and potentially disrupting workflows or hiding previously enabled protections/settings.

Static analysis

No suspicious patterns detected.