obsidian-second-brain

Remote code download and execution detected

curl -sL https://raw.githubusercontent.com/eugeniughelbur/obsidian-second-brain/main/scripts/quick-install.sh | bash

The PostCompact background agent spawns a headless claude subprocess with --dangerously-skip-permissions, driven by the compaction summary. This removes all permission guardrails from an agent whose prompt is partially derived from potentially attacker-influenced conversation content.

'Spawns a headless claude --dangerously-skip-permissions -p subprocess in the vault directory'; 'Agent runs silently, propagates updates, and exits - user sees nothing'

A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.

curl -sL https://raw.githubusercontent.com/eugeniughelbur/obsidian-second-brain/main/scripts/quick-install.sh | bash

The skill configures a background agent that runs autonomously after context compaction, potentially performing unauthorized file modifications without direct user oversight.

A background agent that fires automatically whenever Claude compacts the conversation context.

The skill provides instructions to wire shell scripts into Claude's hook system, granting the skill persistent, automated execution capabilities outside of the user's immediate interaction loop.

"command": "/Users/you/.claude/skills/obsidian-second-brain/hooks/obsidian-bg-agent.sh"

API keys for xAI Grok, Perplexity, YouTube, and OpenAI are stored in ~/.config/obsidian-second-brain/.env and loaded by research scripts. These scripts are executed via uv run against an external package ecosystem, meaning a compromised or supply-chain-attacked dependency could read and exfiltrate these credentials.

'API keys live at ~/.config/obsidian-second-brain/.env. Run install.sh and answer y to the research toolkit prompt'; 'uv run -m scripts.research.x_read', 'uv run -m scripts.research.research'

The research toolkit sends vault content and user queries to external services (Perplexity, Grok, NotebookLM) without explicit per-request confirmation, posing a risk of sensitive data exposure.

Includes a research toolkit (7 commands: /x-read, /x-pulse, /research, /research-deep, /notebooklm, /youtube, /podcast)

The /obsidian-ingest command fetches arbitrary URLs and pasted text, extracts entities and claims, and then uses that content to drive vault writes and subagent spawning. An attacker-controlled webpage or document could embed instructions that the agent treats as authoritative vault rules, especially since _CLAUDE.md content 'overrides the defaults in this skill'.

'/obsidian-ingest': 'Accept a URL, file path, or pasted text as the source... Read or fetch the full source content... Extract: entities, concepts, claims, action items'; '_CLAUDE.md wins on all vault-specific rules'

Multiple commands (/obsidian-save, /obsidian-recap, /obsidian-health, /obsidian-ingest, /research-deep) spawn parallel subagents whose prompts are constructed from vault content and ingested external sources. Since vault content can include attacker-controlled data (ingested URLs, pasted text, X posts), a malicious source could inject instructions into the subagent prompt chain.

'/obsidian-ingest': 'Spawn parallel subagents to distribute knowledge'; '/research-deep': 'Emits a JSON propagation payload... Calling Claude reads that payload and runs /obsidian-save-style propagation: spawns parallel subagents'

The skill grants _CLAUDE.md unconditional precedence over all skill defaults, and /obsidian-init auto-generates this file from vault content discovered at runtime. If an attacker can place content in the vault (e.g., via /obsidian-ingest), they can influence the generated _CLAUDE.md, which then persistently overrides agent behavior across all future sessions.

'_CLAUDE.md wins on all vault-specific rules... Never let skill defaults override an explicit _CLAUDE.md rule'; '/obsidian-init': 'Generate a complete _CLAUDE.md... filled with real values from the vault'

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

SKILL.md links to "hooks/validate-ai-first.hook.yaml" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[`hooks/validate-ai-first.hook.yaml`](hooks/validate-ai-first.hook.yaml)

SKILL.md links to "references/ai-first-rules.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[`references/ai-first-rules.md`](references/ai-first-rules.md)

Skill does not specify a license field. Specifying a license helps users understand usage terms.