Security audit

Obsidian CLI(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This Obsidian automation skill is mostly purpose-aligned, but it exposes powerful vault-changing commands without enough built-in guardrails.

Install only if you intentionally want an agent to administer an Obsidian vault. Before using it, require explicit approval for permanent delete, overwrite, restore, sync pause/resume, plugin install/uninstall, and eval commands, and keep vault backups or Sync history available.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The skill claims security controls such as command whitelisting, no user-input concatenation, TLS, and secret-safe handling, but the file provides no concrete operational constraints enforcing those guarantees. In a skill that exposes exec-capable workflows, unsupported safety claims can cause operators or downstream agents to trust dangerous actions that are not actually bounded.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill advertises a very broad set of trigger keywords and scenarios without strong activation boundaries, making unintended invocation more likely. Because the skill supports file modification, sync operations, plugin management, and developer tooling, accidental triggering could lead to destructive or privacy-impacting actions in a user's vault.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill prominently documents destructive operations such as delete, move, overwrite, restore, and sync manipulation without front-loaded warnings or confirmation requirements. In this context, the danger is elevated because the tool is positioned for automation and team use, where an agent may execute state-changing commands at scale.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The documented `obsidian delete file=... permanent` command is irreversible, yet the skill gives no explicit warning, confirmation gate, or backup guidance. In an automated agent context with exec access, this creates a high risk of permanent knowledge-base data loss from prompt mistakes, ambiguity, or malicious instruction chaining.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents `eval` execution against the Obsidian internal JavaScript API without a clear warning that this is arbitrary code execution inside the application's trusted environment. Given the same skill also exposes exec and development workflows, this substantially increases the risk of local data access, vault manipulation, plugin abuse, or chaining into more dangerous actions.

Static analysis

No suspicious patterns detected.