Security audit
Security checks for vulnerabilities and agentic risk
This clipper is mostly aligned with saving web content to Obsidian, but it needs review because it can send full URLs to third-party services, install unpinned tools, and write downloaded media locally.
Review the URLs and configuration before use, avoid clipping private or tokenized links unless you are comfortable sending them to the listed services, and avoid the curl-to-bash and unpinned dependency install paths unless you first inspect and pin the code you will run.
setup.sh:5Mutable Remote Installer Is Piped Directly into Bash
README.md:60Unpinned Third-Party Tools and Dependencies Create a Supply-Chain Execution Risk
SKILL.md:182Complete User-Supplied WeChat URLs Are Disclosed to a Third-Party Extraction Service
The declared description says the skill clips and saves web content from multiple services into an Obsidian vault. However, the supplied code chunk does not implement clipping, parsing, saving web pages, or handling URLs/triggers. It is purely a setup/installer script for deploying the skill locally and preparing configuration/dependencies. While installation is related support functionality, this chunk’s actual behavior is materially different from the declared end-user purpose, so this specific code chunk does not accurately represent the described behavior.
Following Xiaohongshu short links to a fully resolved URL with required query parameters can pass tracking or access tokens (xsec_token) into subsequent processing and logs. This increases privacy risk and can unintentionally preserve sensitive or session-like URL parameters in notes, shell history, or downstream requests.
If URL is xhslink.com, follow redirects to get the real URL with full query parameters (especially xsec_token):
curl -sL "<short-link>" -o /dev/null -w "%{url_effective}"
Important: The full query string is required. Bare URLs return empty
noteDetailMap.
Piping a fetched script directly into bash eliminates the user's opportunity to inspect the installer and creates an immediate execution chain from network input to shell commands. In the context of a skill installer, this is especially risky because installation runs with the user's local permissions and writes into trusted local tooling paths.
# Obsidian Clipper — installer for Claude Code
#
# One-liner install:
# curl -fsSL https://raw.githubusercontent.com/Gisg/obsidian-clipper/main/setup.sh | bash
#
# Or manual:
# git clone https://github.com/Gisg/obsidian-clipper.git ~/.claude/skills/obsidian-clipper
The description emphasizes convenience but does not clearly warn that the skill will fetch content from third-party URLs, download images/videos, and write notes and attachments into the user's local Obsidian vault. This missing disclosure can mislead users about the skill's side effects, increasing the chance they invoke it without understanding privacy, storage, or content-safety implications.
The README states the skill triggers when a user pastes a URL and says broad phrases like "clip this", "收藏", or "存下来". Because those phrases are common and the skill performs side effects (network fetches, remote media downloads, and filesystem writes into the vault), overly permissive triggering raises the risk of unintended execution and unreviewed writes.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
/skill install @zgissing/obsidian-clipper
After installation, create a `config.yml` in the skill directory (`~/.claude/skills/obsidian-clipper/`):
```yaml
vault:
The skill clearly instructs shell-based actions (curl, python3, npm install, editing config files, copying/downloading media), but it declares no explicit tool scope or allowed-tools boundary. That makes the runtime trust boundary unclear and increases the chance the agent can execute filesystem and network actions more broadly than the user expects.
The trigger is broad enough to activate on routine URL sharing or casual 'save this' language, which could cause unintended network fetches and local writes. Because the skill downloads media and creates files automatically, accidental invocation has privacy and system-impact consequences beyond a harmless formatting action.
The skill directs broad remote fetching and local storage of page content, images, and videos into a user vault without an up-front warning about what data leaves the system and what gets persisted locally. Users may not realize that third-party APIs and sites will receive requested URLs and that potentially large or sensitive content will be written to disk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://api.fxtwitter.com/{handle}/status/{tweet_id}"
Extract from URL: x.com/{handle}/status/{id} → handle, tweet_id.
The skill instructs installing global packages and running external tooling while modifying tool configuration, but it does not clearly warn the user that this executes system-level commands and changes local state outside the vault. This expands the attack surface from clipping into package execution, supply-chain risk, and arbitrary local modifications.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://api.github.com/repos/{owner}/{repo}"
Extract: name, full_name, description, stargazers_count, language, license.spdx_id, topics, created_at, html_url, homepage.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://api.github.com/repos/{owner}/{repo}"
Extract: name, full_name, description, stargazers_count, language, license.spdx_id, topics, created_at, html_url, homepage.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://api.github.com/repos/{owner}/{repo}"
Extract: name, full_name, description, stargazers_count, language, license.spdx_id, topics, created_at, html_url, homepage.
The CDP fallback drives a browser-like endpoint to render and extract dynamic content, images, and videos, which can collect more data than a simple static fetch and may interact with authenticated session context. Without an explicit warning, users may unknowingly scrape personalized or sensitive page state and persist it locally.
The CDP eval endpoint executes supplied JavaScript against a browser target to extract DOM content and media URLs. If the configured CDP service is remote or shared, this transmits page-derived data to another service and can expose dynamic or authenticated content beyond what users expect from a simple clip action.
2. Scroll: `curl -s "{cdp_url}/scroll?target=<ID>&direction=bottom"`
3. Extract title: `curl -s -X POST "{cdp_url}/eval?target=<ID>" -d 'document.title'`
4. Extract body: `curl -s -X POST "{cdp_url}/eval?target=<ID>" -d "document.querySelector('article')?.innerHTML || document.querySelector('main')?.innerHTML || document.body.innerHTML"`
5. Extract images: `curl -s -X POST "{cdp_url}/eval?target=<ID>" -d "[...document.querySelectorAll('img')].map(i=>i.src).filter(s=>s.startsWith('http'))"`
6. Extract videos: `curl -s -X POST "{cdp_url}/eval?target=<ID>" -d "[...document.querySelectorAll('video source, video')].map(v=>v.src||v.querySelector('source')?.src).filter(Boolean)"`
7. Close tab: `curl -s "{cdp_url}/close?target=<ID>"`
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
ln -sf "$SCRIPT_DIR/SKILL.md" "$SKILL_DIR/skill.md"
echo "✓ Linked skill from $SCRIPT_DIR"
else
# Fresh install: clone directly into skills dir
mkdir -p "$HOME/.claude/skills"
git clone https://github.com/Gisg/obsidian-clipper.git "$SKILL_DIR"
echo "✓ Cloned to $SKILL_DIR"
Several output templates hard-code Chinese text such as '的推文', '为什么收藏', '来源', '标签', '公众号', and '核心功能'. The file does not indicate that language should follow user preference or provide an opt-in, so it imposes a specific locale in generated notes.
The script advertises a one-liner that downloads remote code from GitHub and immediately executes it. This is dangerous because any compromise of the repository, branch, hosting path, or network trust chain can result in arbitrary code execution on the user's machine without prior review.
# Obsidian Clipper — installer for Claude Code
#
# One-liner install:
# curl -fsSL https://raw.githubusercontent.com/Gisg/obsidian-clipper/main/setup.sh | bash
#
# Or manual:
# git clone https://github.com/Gisg/obsidian-clipper.git ~/.claude/skills/obsidian-clipper
No suspicious patterns detected.