Obsidian Knowledge Pipeline

将URL文章自动抓取、分类、配图、编译入库Obsidian知识库的7步流水线技能，供Agent复用。

This skill appears to do what it says: it will fetch web articles and write raw files, generated images, a persistent mapping file, compiled wiki nodes, and backlink edits inside the specified Obsidian Vault. Before installing or running: 1) Back up your Vault (the skill will modify many .md files and append a mapping file). 2) Review or sandbox the Vault (use a disposable test vault) to confirm behavior. 3) Only supply DASHSCOPE_API_KEY if you trust the image provider and accept outbound image-generation network calls; prompts and source URLs are stored locally in plain text. 4) Note the skill expects local helper tools/scripts (web_fetch, image_generate, scrapling, Wan2.7) — if those call external services, review them separately. 5) Prefer invoking the skill manually (not granting broad autonomous execution) until you confirm it behaves as expected.

Type: OpenClaw Skill Name: obsidian-knowledge-pipeline Version: 1.0.0 The obsidian-knowledge-pipeline skill automates the ingestion of web content into an Obsidian vault but contains a shell injection vulnerability in its fallback scraping mechanism. In pipeline.md, the agent is instructed to execute a shell command that passes a user-provided URL directly into a python call (`python3 ... "<URL>"`), which could be exploited to achieve arbitrary command execution. While the skill's overall logic is well-structured and aligned with its stated purpose, this vulnerability meets the criteria for a suspicious classification.