Security audit

Obsidian Knowledge Pipeline

Security checks across malware telemetry and agentic risk

Overview

This skill openly automates importing web articles into an Obsidian vault, with expected local file writes and external fetch/image-generation steps but no evidence of hidden or malicious behavior.

Install this only if you want an agent to write into your Obsidian vault. Set OBSIDIAN_VAULT_PATH carefully, keep vault backups or review diffs, and verify any referenced scraping or image-generation helper skills before use. Do not set DASHSCOPE_API_KEY or process private URLs unless you are comfortable with article-derived prompts and metadata being sent to external services.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The pipeline instructs the agent to modify existing Wiki notes by appending reverse links, which expands scope from ingesting a new article into mutating prior user knowledge-base content. In an automated agent setting, this can cause unintended or widespread edits to existing notes, corrupt note structure, and create hard-to-audit changes beyond the user's immediate request.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill claims that any agent can load it and then automatically process arbitrary URL content through a 7-step pipeline, but it does not define clear invocation boundaries, allowed inputs, or safety preconditions. In an agent environment, this broad activation scope increases the chance of unintended execution, causing unreviewed network fetching and filesystem writes into the user's Obsidian vault.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented workflow performs external network access, generates images, creates files, updates mappings, and synchronizes content into the Obsidian vault and Clippings directory, yet it provides no user-facing warning, consent step, or guardrail for these side effects. Because the skill persists remote content into a knowledge base, misuse or accidental invocation could overwrite expectations, ingest untrusted data, and modify a large local document set without clear operator awareness.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The instructions direct the agent to automatically create and append to files inside the user's Obsidian vault, including a persistent mapping file, without requiring confirmation or warning the user that local content will be modified. In an agent setting, silent writes to user knowledge stores can cause unintended persistence, overwrite-adjacent corruption, or accumulation of unreviewed metadata.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs use of an external image-generation capability and references passing an API key via environment variable, but it does not warn that article-derived prompts or metadata may be transmitted to a third-party service. This creates a data exfiltration and privacy risk, especially if prompts are derived from sensitive article content or user vault material.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow directs the agent to append to mapping files, modify existing Wiki nodes, and replace files in `Clippings/` without any explicit warning, confirmation, backup, or change boundary. Because these are persistent user files in an Obsidian vault, silent overwrite/append behavior can lead to data loss, unwanted content drift, and difficult recovery if the agent misclassifies or links incorrectly.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.