ClawHub
Back to skill

Security audit

Obsidian Note To Mind Map

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow wrapper skill that converts user-provided Markdown or a single note into a mind map, with a disclosed user-confirmed dependency install.

Before approving the first-time install, confirm you trust the named core skill and understand that the wrapper will send the provided note content to that installed renderer. Prefer using it only on notes you are comfortable processing with that dependency.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:35
Finding

Unpinned Remote Skill Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–40
Vulnerability Type: Unpinned third-party skill installation
Risk Level: Medium

Vulnerable Code Snippet

markdown
Installation rule:

- Only after explicit user approval, install the exact audited core skill with the runtime's standard ClawHub install flow:
  `clawhub install suka233/kmind-markdown-to-mindmap --workdir ./`
- Never substitute another slug, including localized variants.

Technical Analysis

The installation command identifies the remotely hosted skill only by its mutable ClawHub slug. It does not pin an immutable release version, commit identifier, or cryptographic digest. Consequently, the implementation installed in the future may differ from the implementation that was originally audited.

The dependency's source code is not included in this repository, so this audit cannot verify its effective behavior. Explicit user approval reduces the likelihood of an unnoticed installation, and restricting installation to an exact slug helps prevent accidental substitution, but neither control verifies the integrity of the payload associated with that slug.

Attack Path

  1. An attacker compromises the upstream publisher account, distribution infrastructure, or release process for suka233/kmind-markdown-to-mindmap.
  2. The attacker publishes a modified skill under the same permitted slug.
  3. The wrapper detects that the core skill is unavailable and requests installation approval.
  4. The user approves the documented installation.
  5. The Agent runs clawhub install suka233/kmind-markdown-to-mindmap --workdir ./ without verifying an immutable version or digest.
  6. The wrapper delegates the user-provided note or Markdown content to the modified dependency.
  7. The modified dependency executes within the permissions and environment available to the Agent runtime.

Impact Assessment

A compromised upstream dependency c ...[truncated 603 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an immutable, audited version rather than installing only by slug.
  2. Record and verify a cryptographic digest or trusted signature before installation.
  3. Document the exact upstream release, source revision, and digest that were reviewed.
  4. Reject installation if the retrieved artifact does not match the approved identity and integrity metadata.
  5. Require renewed user approval whenever the pinned version or expected digest changes.
  6. Run the installed renderer with least privilege, restricting filesystem access to the explicitly supplied input and designated output location.
  7. Disable unnecessary network access while processing note content where supported by the runtime.
  8. Periodically re-audit the exact pinned upstream release and its transitive dependencies.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.