[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Obsidian Web Clipper

Version 1.6.1 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Developer: obsidian.md

Rating: 4.8 ★ (499 ratings)

Users: 700,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension is developed by obsidian.md, the official team behind the popular Obsidian note-taking application, which adds significant credibility. With 700,000 users and a strong 4.8-star rating from 499 reviews, it demonstrates good user satisfaction and adoption. The extension serves a legitimate purpose as a web clipper for the Obsidian ecosystem.

Concerns: The extension requests extremely broad permissions that exceed typical web clipper requirements. The combination of all_urls host permissions with clipboardWrite access creates potential for data exfiltration - it could theoretically copy sensitive information from any website to the clipboard. The activeTab permission, while common, combined with broad host access allows interaction with any website content. The scripting permission enables code injection across all sites, which could be misused if the extension were compromised.

Recommendations: Given the high-risk permission profile, consider running this extension in a dedicated Chrome profile separate from sensitive browsing activities like banking or work-related tasks. Monitor clipboard contents after using the extension to ensure no unexpected data is copied. Regularly review the extension's behavior and updates from the developer. If you only clip from specific sites, consider whether a more limited web clipper might meet your needs. The official developer status provides some assurance, but the broad permissions warrant caution with sensitive data.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
clipboardWrite
commands
contextMenus
sidePanel
storage
scripting
declarativeNetRequest

Host Permissions:

<all_urls>
http://*/*
https://*/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (46 total):

http://www.w3.org/1999/xhtml	http://www.w3.org/2000/svg
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/xmlns/
http://www.w3.org/1998/Math/MathML	https://bsky.app
https://bsky.app/profile/	https://c2.com/wiki/remodel/pages/
https://news.ycombinator.com/item?id=	https://www.linkedin.com
https://reddit.com	https://www.threads.com
https://www.threads.com/@	https://publish.twitter.com/oembed?url=
https://api.fxtwitter.com/	https://defuddle.md
https://x.com/	https://www.youtube.com/youtubei/v1/player?prettyPrint=false
https://www.youtube.com/embed/	https://www.youtube.com/youtubei/v1/next?prettyPrint=false
https://www.youtube.com/watch?v=	https://x.com/i/status/
https://help.obsidian.md/Obsidian/Early+access+versions	https://help.obsidian.md/web-clipper/interpreter
https://help.obsidian.md/web-clipper/variables	https://obsidian.md/
https://help.obsidian.md/web-clipper/troubleshoot	https://chromewebstore.google.com/detail/obsidian-web-clipper/cnjifjpddelmedmihgijeibhnjfabmlf
https://addons.mozilla.org/en-US/firefox/addon/web-clipper-obsidian/	https://apps.apple.com/us/app/obsidian-web-clipper/id6720708363
https://microsoftedge.microsoft.com/addons/detail/obsidian-web-clipper/eigdjhmgnaaeaonimdklocfekkaanfme	https://raw.githubusercontent.com/obsidianmd/obsidian-clipper/refs/heads/main/providers.json
https://github.com/highlightjs/highlight.js/issues/2277	https://github.com/highlightjs/highlight.js/wiki/security
https://img.youtube.com/vi/	https://www.youtube.com
https://www.youtube.com/	http://www.w3.org/2000/svg%27
http://www.w3.org/1999/xlink%27	http://www.serif.com/%27
http://www.w3.org/1999/xlink	https://clients2.google.com/service/update2/crx
https://github.com/obsidianmd/obsidian-clipper/releases	https://help.obsidian.md/web-clipper
https://stephango.com/file-over-app	https://example.com/

Raw Manifest

{
  "name": "Obsidian Web Clipper",
  "icons": {
    "16": "icons/icon16.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_popup": "popup.html"
  },
  "version": "1.6.1",
  "commands": {
    "quick_clip": {
      "description": "__MSG_commandQuickClip__",
      "suggested_key": {
        "mac": "Alt+Shift+O",
        "default": "Alt+Shift+O"
      }
    },
    "toggle_reader": {
      "description": "__MSG_commandToggleReader__",
      "suggested_key": {
        "mac": "Alt+Shift+R",
        "default": "Alt+Shift+R"
      }
    },
    "_execute_action": {
      "description": "__MSG_commandOpenClipper__",
      "suggested_key": {
        "mac": "Command+Shift+O",
        "default": "Ctrl+Shift+O"
      }
    },
    "toggle_highlighter": {
      "description": "__MSG_commandToggleHighlighter__",
      "suggested_key": {
        "mac": "Alt+Shift+H",
        "default": "Alt+Shift+H"
      }
    }
  },
  "background": {
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "settings.html",
    "open_in_tab": true
  },
  "side_panel": {
    "default_path": "side-panel.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Save and highlight web pages in a private and durable format that you can access offline. The official extension for Obsidian.",
  "permissions": [
    "activeTab",
    "clipboardWrite",
    "commands",
    "contextMenus",
    "sidePanel",
    "storage",
    "scripting",
    "declarativeNetRequest"
  ],
  "homepage_url": "https://obsidian.md/",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "browser-polyfill.min.js",
        "content.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>",
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "reader.css",
        "reader-script.js",
        "browser-polyfill.min.js",
        "style.css",
        "side-panel.html",
        "flatten-shadow-dom.js",
        "highlighter.css"
      ],
      "extension_ids": [
        "*"
      ]
    }
  ]
}

by ✦ Astarte

Obsidian Web Clipper

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (46 total):

Raw Manifest

Detections

Manifest Findings