Obsidian Vault Curator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 1.1.0

Overview

This skill is a cautious Obsidian/Markdown vault organizer with read-only helpers and explicit review gates before edits.

Install this only if you want an agent to read and help organize selected Markdown or Obsidian vault areas. Review proposed write slices before allowing edits, especially for notes containing secrets, PII, operational details, or large folder restructures.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a high-level vault organization and migration-planning skill focused on curation, classification, review design, and safe cleanup. The supplied code instead performs a concrete technical audit: scanning Markdown files and checking Obsidian wikilinks for unresolved or ambiguous targets within the provided directory slice. While link checking could loosely support vault review, it is not represented in the description and the code does not implement the core described behaviors such as classification, canonical page definition, historical/current/future-state separation, dashboard design, or migration planning. Therefore the code's actual primary purpose is materially different from the declared purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- The requirement is surfaced in metadata as `requires.bins: ["python3"]`.
- On macOS, the metadata includes a Homebrew install hint.
- On Linux, install Python 3 with your distro package manager, for example `sudo apt install python3`, then verify `python3 --version`.
- On Windows, install Python from the official Python Install Manager or with `winget install Python.Python.3.14`, then open a new terminal and verify that `python3 --version` works. If only `python` works, add a `python3` alias or shim on `PATH` before using this skill.
- The bundled helper scripts in `scripts/` use only the Python standard library.
- No extra Python packages are required.

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Use when status is unclear.
Signals:
- mixed old and new facts
- no verification date, or `last_verified` older than 90 days for a note claiming `status: current`
- conflicts with better evidence
- unclear whether the note is still active

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown file includes a language-specific instruction: concept notes are identified using signal words 'in German or English.' That constrains the classification behavior to specific languages without stating user opt-in or a documented justification for excluding other languages, which matches the locale-policy concern for natural-language content.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The example link text `[[OpenClaw Runtime & Konfiguration]]` uses German wording inside an otherwise English reference document. This can be a natural-language locale policy issue because it introduces a specific language choice without indicating user opt-in or documenting that the schema is intended for a German-language or multilingual environment.

Static analysis

No suspicious patterns detected.