Clip to Your Vault

• Outcome: Review
• Latest audit: May 28, 2026 · 2:59 PM UTC
• Version: 1.0.0

Overview

The core Obsidian web clipper is understandable, but optional browser-session and third-party downloader paths give it sensitive, under-scoped access.

Install only if you are comfortable with selected URLs being fetched and saved, along with images or videos, into the configured vault folder. Keep the vault path narrow, review third-party Douyin tooling before enabling it, use a separate browser profile or account for cookie-based workflows, keep CDP disabled unless needed, and if enabled keep it on a trusted localhost endpoint only.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly instructs the agent to execute shell commands (`curl`, `python3`, `cd`, `npm install`) but does not declare that capability or warn the user about command execution. Hidden shell capability increases the chance of unexpected local command execution and network activity under an innocuous clipping description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The described purpose is clipping URLs into Obsidian, but the skill behavior also includes environment modification and dependency installation/init steps that go beyond clipping. That mismatch can mislead users into granting trust to a skill that may clone repositories, create symlinks, or initialize config on the local machine.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrase "clip this" is broad and plausible in ordinary conversation, which can cause the skill to activate when the user did not intend to invoke a web-clipping workflow. In this skill, activation can lead to network fetches and local file writes into the Obsidian vault, so accidental invocation has meaningful side effects.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The README explicitly says the skill downloads images/videos and writes formatted notes into the user's Obsidian Vault, but it does not foreground that this causes local filesystem modifications. Because the skill ingests arbitrary URLs and persists fetched content, users may underestimate the privacy, storage, and overwrite risks of running it.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger is broad enough to activate on ordinary conversations containing a URL plus words like save/clip/收藏, which may cause unintended fetching and local writes. In a skill that performs network requests and downloads media, accidental invocation materially raises security and privacy risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is designed to download remote content and media and save them into a local vault, but the instructions do not require an explicit warning or confirmation about file writes and network access. Because it handles arbitrary user-supplied URLs across many domains, this omission can lead to silent exfiltration requests and unexpected persistence of downloaded content.

External Transmission

Medium

• Category: Data Exfiltration

Content

2. Scroll: `curl -s "{cdp_url}/scroll?target=<ID>&direction=bottom"`
3. Extract title: `curl -s -X POST "{cdp_url}/eval?target=<ID>" -d 'document.title'`
4. Extract body: `curl -s -X POST "{cdp_url}/eval?target=<ID>" -d "document.querySelector('article')?.innerHTML || document.querySelector('main')?.innerHTML || document.body.innerHTML"`
5. Extract images: `curl -s -X POST "{cdp_url}/eval?target=<ID>" -d "[...document.querySelectorAll('img')].map(i=>i.src).filter(s=>s.startsWith('http'))"`
6. Extract videos: `curl -s -X POST "{cdp_url}/eval?target=<ID>" -d "[...document.querySelectorAll('video source, video')].map(v=>v.src||v.querySelector('source')?.src).filter(Boolean)"`
7. Close tab: `curl -s "{cdp_url}/close?target=<ID>"`

• Confidence: 79% confidence
• Finding: The CDP fallback sends arbitrary JavaScript snippets and page-derived content to a configurable remote CDP endpoint, which may expose the full contents of visited pages, including authenticated or sensitive data loaded in the browser context. Because `config.web.cdp_url` is externally configurable, this can become a powerful data exfiltration path if pointed at an untrusted service.

External Script Fetching

High

• Category: Supply Chain

Content

If URL is `xhslink.com`, follow redirects to get the real URL **with full query parameters** (especially `xsec_token`):

```bash
curl -sL "<short-link>" -o /dev/null -w "%{url_effective}"
```

> **Important**: The full query string is required. Bare URLs return empty `noteDetailMap`.

• Confidence: 77% confidence
• Finding: Following arbitrary short links and preserving full query parameters increases risk because tracking tokens and access tokens embedded in redirected URLs may be captured, stored, or reused. In this skill, those parameters are then used for additional fetching and may be written into notes or logs, expanding the privacy and leakage surface.

Static analysis

No suspicious patterns detected.