ClawHub
Back to skill

Security audit

Obsidian Knowledge Pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but it needs review because it can automatically fetch web content, use external image-generation services, and make persistent changes across an Obsidian vault, including existing notes.

Review before installing if your Obsidian vault contains sensitive or important notes. Set OBSIDIAN_VAULT_PATH to a test vault first, avoid confidential URLs unless you accept external fetching and image-generation use, and inspect planned backlink and Clippings changes before letting an agent run the full workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (17)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill describes an automated pipeline that creates files, writes into an Obsidian vault, and may copy or soft-link compiled results into a Clippings directory, but it does not clearly warn users up front that loading or running the skill can modify local knowledge-base contents. That omission can cause users or calling agents to trigger unintended filesystem changes, especially because the workflow is framed as automatic and mandatory across all 7 steps.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs agents to fetch arbitrary external URLs and optionally send prompts or content-derived data to a third-party image generation service via DASHSCOPE, but it provides no explicit privacy or data-handling warning. This increases the risk of exposing browsing targets, article contents, metadata, or derived summaries to external services without informed user consent.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
Line L048 states that for foreign-language articles, the Wiki compilation node must be written in Chinese. This imposes a specific language requirement without any user opt-in or documented regional/compliance justification, which matches the locale-policy violation criteria.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill routes content into external image-generation mechanisms (Wan2.7 or image_generate) but does not warn that prompts derived from article content may be transmitted to third-party or remote services. If articles contain confidential topics, names, business information, or sensitive concepts, the generated prompt and related metadata could be exposed off-box without the user's awareness.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
The skill file is written entirely in Chinese and specifies Chinese naming conventions such as `关联关系.md`, Chinese prompt templates, and Chinese category defaults, with no indication that language is configurable. This can violate a language/locale policy when users have not opted into Chinese output or operation.

Session Persistence

Medium
Category
Rogue Agent
Content
CLIPPINGS_DIR="$VAULT/Clippings"

# 确保目录存在
mkdir -p "$RAW_DIR" "$IMAGES_DIR" "$WIKI_DIR" "$CLIPPINGS_DIR"
```

---
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
CLIPPINGS_DIR="$VAULT/Clippings"

# 确保目录存在
mkdir -p "$RAW_DIR" "$IMAGES_DIR" "$WIKI_DIR" "$CLIPPINGS_DIR"
```

---
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The workflow performs extensive file creation, copying, and modification across multiple vault directories, including raw, wiki, images, mapping, and clippings, yet provides no user-warning, approval gate, or dry-run mode. In an agentic context, this increases the chance of unintended bulk changes, overwrites, and persistence of untrusted fetched content.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The knowledge-graph step instructs the agent to modify pre-existing wiki notes by appending backlinks, expanding writes beyond the newly ingested article. This creates an integrity risk because a fetched article can indirectly cause broad, semi-automated edits across an existing knowledge base without per-file confirmation or tight scoping.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The template labels, placeholders, and section headings are all written in Chinese, which effectively constrains generated content to a specific language/locale. There is no indication that the user can choose another language or that the restriction is justified as a region-specific template.

Natural-Language Policy Violations

Low
Confidence
72% confidence
Finding
The manifest description is entirely in Chinese and the skill uses Chinese naming/content conventions throughout, but it does not state that the locale is intentionally China-specific or offer an opt-in language choice. Under the stated policy, forcing a specific language without user choice can be a natural-language policy issue unless the regional constraint is documented and justified.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
The line states `中文 prompt 即可`, which imposes a specific language expectation for skill operation. There is no user opt-in, alternative locale option, or stated regional justification for this constraint.

Missing User Warnings

Low
Confidence
92% confidence
Finding
The skill instructs the agent to automatically create and append to a persistent mapping file inside the Obsidian vault without any explicit user notice, consent gate, or dry-run option. Because the file stores article titles, paths, prompts, timestamps, and status history, it creates durable metadata and history in user content that may be unexpected and difficult to audit or roll back.

Missing User Warnings

Low
Confidence
87% confidence
Finding
Step 1 directs the agent to fetch arbitrary URLs using web_fetch and a fallback scraping script, which causes external network access and may transmit the requested URL or related context to external services. The markdown does not warn users that executing this workflow involves outbound requests to third-party sites/tools.

Context-Inappropriate Capability

Low
Confidence
76% confidence
Finding
The manifest describes a 7-step pipeline for fetching, classifying, illustrating, and compiling articles into an Obsidian knowledge base. While image generation itself is in scope, this section adds capability to inspect an environment credential (`DASHSCOPE_API_KEY`) and delegate work to another local skill path, which is a broader execution/integration capability not clearly justified by the manifest text alone.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The template uses Chinese field labels and status text throughout, such as the title placeholder and table headers, which imposes a specific language by default. Under the policy, forcing a specific language without offering a language or locale choice can be a natural-language policy violation.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
This markdown template uses Chinese-only field names and labels throughout, such as '文章标题', '作者', and '处理状态：待编译'. Because the file provides no opt-in, alternative locale, or justification that the skill is region-specific, it appears to impose a specific language by default.

Static analysis

No suspicious patterns detected.