ClawHub
Back to skill

Security audit

Secure Obsidian LiveSync Server Setup

Security checks for vulnerabilities and agentic risk

Overview

The guide is coherent, but its support for older Docker versions can expose the database to nearby machines despite its host-only access claim.

Use Docker 28.0.0 or a verified patched equivalent, and verify database isolation from another machine before syncing private notes. Review downloaded scripts, protect credentials and Setup URIs, and expect persistent services and Cloudflare DNS changes. The scanner's flagged cleanup, credential-file guidance, and service persistence fit this deployment; the Review verdict rests on the documented isolation gap.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

export hostname=http://127.0.0.1:5984 username=$COUCHDB_USER password=$COUCHDB_PASSWORD database=obsidiannotes bash /tmp/couchdb-init.sh

成功标志: CouchDB provisioning completed.

rm -f /tmp/couchdb-init.sh

text
验证（交互式终端，curl 单独提示输入口令，不把口令放进进程参数）：
```bash

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

curl -u "$COUCHDB_USER" http://127.0.0.1:5984/_up # 期望 {"status":"ok"} curl -u "$COUCHDB_USER" http://127.0.0.1:5984/_all_dbs # 应含 obsidiannotes

text
无人值守/自动化场景改用权限受限的 `~/.netrc`（`chmod 600`）或 `.curlrc` 里的 `--user`，不要用 `curl -u user:pass`：变量展开后的值会短暂出现在 `/proc/<pid>/cmdline`，同机其他用户可读。curl 官方文档对此有明确提示。
该脚本会开启 `require_valid_user`、设置 LiveSync 需要的 CORS origins、并建库。

5. **Cloudflare Tunnel**：

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

  1. 目录与权限（uid 必须 5984，否则容器起不来）：
    bash
    sudo mkdir -p /opt/obsidian-livesync/{couchdb-data,couchdb-etc}
sudo chown -R 5984:5984 /opt/obsidian-livesync/couchdb-{data,etc}
sudo chmod 750 /opt/obsidian-livesync

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

  1. 目录与权限（uid 必须 5984，否则容器起不来）：
    bash
    sudo mkdir -p /opt/obsidian-livesync/{couchdb-data,couchdb-etc}
sudo chown -R 5984:5984 /opt/obsidian-livesync/couchdb-{data,etc}
sudo chmod 750 /opt/obsidian-livesync
    路径可换，但下面所有命令要跟着换。

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

bash
   sudo mkdir -p /opt/obsidian-livesync/{couchdb-data,couchdb-etc}
   sudo chown -R 5984:5984 /opt/obsidian-livesync/couchdb-{data,etc}
   sudo chmod 750 /opt/obsidian-livesync

路径可换，但下面所有命令要跟着换。

Docker image referenced without tag or digest: 'docker run --name'.

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run 在无'.

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

  • 写 ~/.cloudflared/config.yml：ingress hostname: <域名> → service: <redacted-url> http_status:404`（必须留，否则隧道拒绝启动）
    • credentials-file 指向 tunnel create 实际写出的 JSON；cloudflared service install 会把配置和凭证复制到 /etc/cloudflared/，手写配置时路径对不上是"隧道起不来"的常见原因
    • cloudflared tunnel route dns obsidian-livesync <域名>（自动加 CNAME）
    • cloudflared service install && systemctl enable --now cloudflared，日志确认 4 条 Registered tunnel connection
  1. 生成 Setup URI（E2E passphrase 生成后也存为 LIVESYNC_PASSPHRASE，并让用户存进密码管理器）：
    bash

Docker image referenced without tag or digest: 'docker run 即可，不必先装'.

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.