Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently saves user-provided web pages into Obsidian notes, with expected network fetching and local note writing that users should understand before use.
Install only if you are comfortable with a skill fetching URLs through available web tools and writing Markdown files into your Obsidian vault. Avoid using it on confidential or login-only pages unless you understand which fetch backend is being used, and review saved command examples before running anything from the resulting notes.
The template includes a classic 'curl | sh' install command that fetches and immediately executes a remote script without integrity verification. In a skill that captures web content into notes, preserving such commands can normalize unsafe execution patterns and may facilitate copy-paste compromise if users trust the generated note content.
curl -sS https://starship.rs/install.sh | sh
The shell pipe into 'sh' is a dangerous command-chaining pattern because it converts remote content directly into executable shell input. Even though this appears in a markdown example, the surrounding skill context makes it more dangerous because the skill is designed to save and present third-party web content, increasing the chance users may later trust and run reproduced commands from notes.
curl -sS https://starship.rs/install.sh | sh
The skill description does not prominently warn users that supplied URLs and fetched page content may be sent through external tools/services and then written into the local Obsidian vault. In this context, that omission is security-relevant because the workflow explicitly uses multiple fetch backends and persistent local writes, so users may unknowingly expose sensitive URLs/content or authorize storage changes without informed consent.
The trigger list contains broad, everyday phrases such as '收藏到 obsidian' and '保存到 obsidian', which increases the chance of accidental invocation in normal conversation. In this skill's context, accidental invocation is meaningful because it can cause external URL fetching and local file writes into the user's Obsidian vault, potentially transmitting content to third-party services and creating unwanted notes.
The manifest description frames the skill as fetching a URL and saving it as an Obsidian note, with user-guided choices. However, the documentation additionally instructs probing existing vault directories via obsidian_list_files_in_vault, which is not present in allowed-tools and expands behavior beyond the clearly described fetch-and-save flow.
This markdown file contains natural-language instructions that force a specific language context through Chinese-only headings and mandatory wording such as '不可违反' and '必须'. Under the policy, language or locale constraints should either be optional for the user or clearly justified as region-specific.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://api.openai.com/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://api.openai.com/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-d '{
At L033 the instructions state the purpose of prechecking is to avoid waiting for timeout before degrading. But the later operational rules still list command timeout as a downgrade condition for opencli, which contradicts the stated intent rather than merely omitting detail.
No suspicious patterns detected.