Gbrain Obsidian Vault

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent local Obsidian/gbrain integration, but it includes under-scoped file and Git operations that users should review before running.

Install only if you are comfortable letting the skill modify your selected Obsidian vault and expose OpenClaw memory notes inside it. Before running setup, back up existing `.obsidian` config and verify any existing `memory` symlink. Before committing exports, inspect `git status` and stage only the generated paths instead of using `git add -A`.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-vault.sh:20

Finding

Existing Memory Symlink Is Accepted Without Target Validation

Content

View full analysis

$MEMORY_DIR" fi ``` ### Technical Analysis The script treats any existing `$WIKI_DIR/memory` symbolic link as valid. It does not resolve the link or verify that its canonical target is the configured `MEMORY_DIR`. Consequently, a stale, misconfigured, or attacker-created symbolic link can point to an unrelated directory while the setup process reports success. Because the wiki is subsequently opened as an Obsidian vault, files under the unintended target may be displayed, searched, indexed by enabled Obsidian functionality, or modified through the user interface. Exploitation requires an attacker or another local process to be able to create or alter the link in the user-controlled wiki directory. This does not independently bypass operating-system permissions; Obsidian and the script retain the privileges of the invoking user. ### Attack Path 1. The attacker obtains write access to the victim's wiki directory or otherwise influences its preexisting contents. 2. The attacker creates `$WIKI_DIR/memory` as a symbolic link to another directory accessible to the victim, such as a directory containing unrelated private documents. 3. The victim runs `scripts/setup-vault.sh`. 4. The script detects that `memory` is a symbolic link but does not inspect its target. 5. The script reports that the memory link already exists and continues successfully. 6. The victim opens `$WIKI_DIR` as an Obsidian vault. 7. The unintended target's files become accessible through the ...[truncated 548 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/setup-vault.sh:44

Finding

Setup Script Unconditionally Overwrites Existing Obsidian Configuration

Content

View full analysis

"$OBSIDIAN_DIR/app.json" <<'JSON' { "useMarkdownLinks": false, "newLinkFormat": "absolute", "alwaysUpdateLinks": false, "showUnsupportedFiles": false, "attachmentFolderPath": "./", "promptDelete": true } JSON cat >"$OBSIDIAN_DIR/core-plugins.json" <<'JSON' { "file-explorer": true, "global-search": true, "switcher": true, "graph": true, "backlink": true, "outgoing-link": true, "tag-pane": true, "page-preview": true, "daily-notes": false, "templates": false, "note-composer": true, "command-palette": true, "editor-status": true, "outline": true, "word-count": true, "file-recovery": true } JSON ``` ### Technical Analysis The shell redirection operator `>` truncates each destination before writing the new JSON. The script neither checks whether the files already exist nor creates backups or merges the required properties into the current configuration. Running setup against an established vault therefore discards all preexisting keys in `app.json` and `core-plugins.json`, including settings unknown to this project. Although the replacement configuration shown here does not contain an overtly malicious option, silently destroying configuration is unsafe and contradicts the script's claim of idempotent vault wiring. This is primarily an integrity and availability issue. Exploitation does not provide elevated privileges, but it can be used to induce predictable configuration changes if an attacker persuades a user to run the script against an existing vault. ### Attack Path 1. The victim has an existing Obsidian vault with customized application and core-plugin settings. 2. The victim points `WIKI_DIR` at that vault and runs `scripts/setup-vault.sh`. 3. The s ...[truncated 797 chars]

Remediation

View remediation

"$tmp" mv -- "$tmp" "$OBSIDIAN_DIR/app.json" ``` Equivalent merge and validation logic should be applied to `core-plugins.json`. The implementation should also handle absent or malformed existing files explicitly. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60

Finding

Documentation Recommends Broad Staging of Unrelated Vault Changes

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 106)May include surrounding context.

Add to AGENTS.md skillpack table:

markdown

| "obsidian脑库" / "第二大脑可视化" / "gbrain obsidian" / "memory图谱" | `skills/gbrain-obsidian-vault/SKILL.md` |

Cursor

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document states that DB writes automatically create or update markdown files in the user's wiki and that another component auto-commits them later, but it does not present any explicit warning, consent step, or operational safeguard. This is dangerous because users may unknowingly enable persistent file modification and version-control side effects, which can overwrite notes, leak sensitive content into a repo history, or create hard-to-reverse changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.