C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools, Web & browsing
obsidian-second-brain
Persistent memory for Claude Code and 6 other CLI agents, stored as plain markdown in your Obsidian vault. Stop re-explaining your projects, decisions and people every session. 45 commands: hybrid semantic search, self-rewriting notes, key-less web research, and scheduled agents that maintain the vault while you sleep.
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 42/100
- Rank
- #283 of 500
- GitHub stars
- 4.8k
What it does
Provides persistent memory for Claude Code and CLI agents by storing conversation context, project decisions, and people details as searchable markdown in your Obsidian vault. Includes 45 commands for semantic search, self-updating notes, web research, and scheduled background maintenance of your vault.
Who it’s for
Builders and executives who run multiple AI agent sessions and want to avoid re-explaining project context, decisions, and team information across conversations. Best suited for users already invested in Obsidian as their knowledge management system.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/eugeniughelbur/obsidian-second-brain (opens external site) for the latest installation method. Likely involves cloning the repo, installing dependencies, and configuring an environment variable pointing to your local Obsidian vault path.
Risks
- Local file access: Agents gain read/write access to your entire Obsidian vault; malicious prompts or injected instructions could exfiltrate or corrupt sensitive notes.
- Unencrypted storage: Vault contents are plain markdown on disk; no built-in encryption means sensitive decisions or credentials stored as notes remain readable by local processes.
- Prompt injection via notes: Self-rewriting notes feature could be exploited if agent output is injected back into vault queries, creating feedback loops that bypass safety guidelines.
- Scheduled agent autonomy: Background agents that modify vault "while you sleep" run without human review; scope and trigger conditions should be carefully audited.
- Third-party dependencies: Web research commands may make unauthenticated external requests; verify no API keys or auth tokens are logged in vault or transmitted insecurely.
How to stay secure
Least-privilege permissions
- Restrict agent access to specific folders within Obsidian instead of granting read/write permission to your entire vault; keep sensitive notes (passwords, financial decisions, personal records) in a separate folder that agents cannot access.
- Review and limit the 45 commands available to agents—disable any commands (especially "self-rewriting notes" and "scheduled agents") that you don't actively use; fewer active tools means fewer ways an agent can be misused.
- Require manual approval for scheduled agents before they run; never leave background agents running unattended if they can modify your vault—check their logs each morning to confirm they only changed what you intended.
Network isolation
- Disable or audit the "web research" commands that make external requests; if they must run, verify that your Obsidian vault is not connected to the internet and that agents cannot send vault contents outside your computer.
- Use a firewall or host-level rules to prevent the agent processes from accessing the network entirely, unless web research is essential—if allowed, log all outbound connections and block any requests to unknown domains.
- Never store API keys, passwords, or authentication tokens as plain text notes in your vault; if agents need credentials for web research, store them in a separate encrypted password manager and reference only the name, not the value.
Monitoring
- Enable audit logs or version history in Obsidian to track all changes to your vault; review any unexpected modifications, especially to notes you did not manually edit.
- Set up a weekly manual spot-check of high-value notes (decisions, project summaries, people profiles) to detect if agents have corrupted or altered them without permission.
- Watch for unusual agent behavior: agents taking longer than normal to complete tasks, generating very long outputs, or requesting access to new folders—these may signal a prompt injection attack or misconfiguration.
Red flags to watch for
- Notes that reference your vault contents in unexpected contexts (e.g., summaries of your personal notes appearing in web search results or agent logs shared outside your machine).
- Scheduled agents that run even after you disable them, or agents that modify notes you marked as "read-only"—these suggest the skill has lost control or an external process is overriding your permissions.
- Garbled or nonsensical edits to notes (especially self-rewriting notes that loop back into agent queries), or notes that suddenly contain new instructions you did not write—classic signs of prompt injection feedback loops.
Alternatives
- LangChain memory modules – Framework-native persistent memory with better audit trails and permission boundaries.
- Mem0 or similar managed memory layers – Cloud-hosted conversation context with encryption and access controls.
- Retrieval-Augmented Generation (RAG) over private docs – Purpose-built vector stores (Pinecone, Weaviate) with clearer data governance.
- Claude Projects – Native Claude feature for grouping conversations and file context without external vault dependency.