ClawHub
Back to skill

Security audit

Obsidian Vault Context

Security checks for vulnerabilities and agentic risk

Overview

The skill’s vault workflow is coherent, but its optional sync setup asks users to install a global package and create a boot-persistent system service with broad vault access.

Review this before installing if you plan to use server sync. The basic vault instructions are bounded to the vault, but the optional headless setup can create a long-running system service with access to synced notes and stored Obsidian credentials. Prefer a pinned package version, a dedicated unprivileged account, a user-level or sandboxed service, selective sync, and a clear uninstall procedure before enabling continuous sync.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
references/obsidian-headless-setup.md:82
Finding

Persistent System-Wide Obsidian Sync Service

Content
View full analysis
Remediation
View remediation
/.openclaw/vault` - `RestrictSUIDSGID=true` - `LockPersonality=true` 5. Use a bounded restart policy such as `Restart=on-failure` with systemd rate limits instead of `Restart=always`. 6. Reference a verified, version-pinned executable rather than a mutable global installation. 7. Document complete removal procedures, including stopping and disabling the unit, deleting the service file, and reloading systemd. ]]>

T08 · Insecure Dependencies

Warning
Location
references/obsidian-headless-setup.md:26
Finding

Unpinned Global Installation Used by Persistent Service

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger scope is broad enough to activate on essentially any vault-related file operation, which increases the chance the skill is invoked in situations the user did not explicitly intend. Because the skill has write-oriented behavior and persistent state management, overbroad activation can cause unnecessary reading or modification of vault files and amplify downstream risk from mistaken context selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly instructs the agent to create orchestration files in a fresh vault and to update state files during normal operation, but it does not require clear user notice or confirmation before making persistent changes. In a shared workspace, silent or assumed writes can overwrite user expectations, introduce unwanted artifacts, and create lasting state that affects future sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/obsidian-headless-setup.md (reported line 37)May include surrounding context.

md
ob sync-list-remote

# Navigate to (or create) the local vault directory
mkdir -p ~/.openclaw/vault
cd ~/.openclaw/vault

# Connect to your remote vault

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/obsidian-headless-setup.md (reported line 84)May include surrounding context.

For continuous sync on a Linux server:

bash
sudo tee /etc/systemd/system/obsidian-sync.service << 'EOF'
[Unit]
Description=Obsidian Headless Sync
After=network-online.target

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/obsidian-headless-setup.md (reported line 102)May include surrounding context.

For continuous sync on a Linux server:

bash
sudo tee /etc/systemd/system/obsidian-sync.service << 'EOF'
[Unit]
Description=Obsidian Headless Sync
After=network-online.target

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/obsidian-headless-setup.md (reported line 103)May include surrounding context.

For continuous sync on a Linux server:

bash
sudo tee /etc/systemd/system/obsidian-sync.service << 'EOF'
[Unit]
Description=Obsidian Headless Sync
After=network-online.target

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/obsidian-headless-setup.md (reported line 104)May include surrounding context.

For continuous sync on a Linux server:

bash
sudo tee /etc/systemd/system/obsidian-sync.service << 'EOF'
[Unit]
Description=Obsidian Headless Sync
After=network-online.target

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/obsidian-headless-setup.md (reported line 109)May include surrounding context.

For continuous sync on a Linux server:

bash
sudo tee /etc/systemd/system/obsidian-sync.service << 'EOF'
[Unit]
Description=Obsidian Headless Sync
After=network-online.target

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/obsidian-headless-setup.md (reported line 103)May include surrounding context.

EOF

sudo systemctl daemon-reload sudo systemctl enable obsidian-sync sudo systemctl start obsidian-sync

text

Static analysis

No suspicious patterns detected.