Security audit

Session Daily Backup - Obsidian

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it advertises, but it needs review because it can repeatedly copy full OpenClaw conversation history into Obsidian files and optionally send alert metadata externally.

Install only if you intentionally want OpenClaw conversations copied into persistent Obsidian Markdown files. Use a private, access-controlled vault, be careful with cloud sync, review or remove the cron job when no longer needed, and leave QQ notification settings disabled unless you accept sending token-alert metadata through that channel.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README prominently advertises automatic backup of OpenClaw session conversations to an Obsidian vault, but it does not warn users that potentially sensitive prompts, responses, secrets, and personal data will be copied into local markdown files. In a skill specifically designed to persist chat history, the lack of disclosure materially increases the risk of unintended data retention and exposure through local sync, backup, or sharing workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README instructs users to install a cron job that performs unattended daily backups of session conversations, but it does not clearly disclose that this creates ongoing scheduled collection and storage of chat content. That omission is risky because users may enable persistent automated retention without understanding the privacy implications or the chance that sensitive data will accumulate over time.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly describes automatic backup of OpenClaw conversation/session data into an Obsidian vault and QQ-based warning notifications, but it does not prominently warn users about the privacy and data-exposure implications of copying potentially sensitive chat history to another storage location and transmitting metadata through a messaging service. In a backup skill, this omission is security-relevant because users may enable automation without understanding retention, local exposure, or notification-channel leakage risks.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script automatically writes full conversation session contents to a Markdown file in `VAULT_DIR` without any consent prompt, visibility control, or permission hardening. In this context, session files can contain secrets, personal data, or sensitive operational history, so silent persistence to disk increases the risk of unintended disclosure via local compromise, sync services, backups, or shared vault access.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script transmits conversation-derived status data to external messaging infrastructure (`openclaw` or QQ HTTP API) without explicit user disclosure or consent. Even though the message content is limited to token/utilization warnings, it still reveals metadata about active conversations and operational state to external services, which may be sensitive in some deployments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This script deliberately exports the entire latest conversation transcript to a Markdown file in a notes vault without any confirmation, redaction, or warning that sensitive prompts, secrets, or personal data may be persisted to disk. In an agent-skill context, conversations commonly contain credentials, internal paths, or private user content, so silent full-session export materially increases confidentiality risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script automatically locates and reads the newest session JSONL file from a default directory under /root, then processes its full contents for export, without disclosing that it is accessing potentially sensitive local conversation history. This is risky because the latest session may contain unrelated or highly sensitive data, and the default privileged path makes the behavior more dangerous in environments where the skill runs with elevated access.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.