Security audit
Security checks for vulnerabilities and agentic risk
Awaek mostly matches its stated local X-bookmark purpose, but its installer guidance and handling of third-party post text need review before use.
Install only if you are comfortable giving the skill local access to an authenticated xurl setup for your X bookmarks and storing those bookmarks in a local SQLite database. Avoid the documented curl-to-bash prerequisite install unless you have independently verified the xurl installer or use a safer pinned/package-managed method. Treat answers as based on saved social posts, not trusted instructions from those posts.
README.md:123Unpinned Remote Installer Is Piped Directly into Bash
skills/awaek/scripts/answer_pack.py:583Untrusted Bookmark Content Is Embedded into Agent Context Without Prompt-Injection Isolation
The use of '| bash' removes any opportunity for meaningful inspection before execution and turns a remote content fetch into immediate command execution. In an agent-installation context, this is more dangerous because users may copy commands verbatim and trust the workflow, increasing the likelihood of silent compromise.
Install xurl:
curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash
Check X authentication:
The code chunk is a simple CLI utility for retrieving link records or link statistics from a database and outputting them as JSON. The declared description presents a higher-level personal source engine focused specifically on saved X bookmarks/posts and decision-support workflows. This snippet does not show those behaviors; instead it exposes generic link listing/stats functionality. While it could be a supporting component of such a system, on its own it does not accurately represent the declared purpose, especially because it refers to generic links and pending status rather than saved X bookmarks or source-engine features.
The declared description emphasizes a personal search/reasoning engine over saved X bookmarks, supporting tasks like asking, drafting, deciding, and planning from saved posts. The supplied code instead is a CLI utility that queries a db module for topics and learned-topic summaries, then prints JSON. There is no visible logic here for searching bookmarks, retrieving saved posts, or providing evidence-based assistance over X bookmarks. While topic extraction could be a supporting component of such a system, this specific chunk's primary observable behavior is listing database topics and learned-category suggestions, which is materially different from the declared end-user purpose and is not reflected in the description.
The declared description suggests an end-user skill for querying and working with saved X bookmarks as a personal source engine. The supplied code chunk instead implements infrastructure/setup behavior: it initializes the DB, checks FTS5 availability, inspects versions of external commands, and prints health/status JSON. It does not show functionality for asking questions, drafting, deciding, planning, or accessing saved X bookmarks. While setup code can support the overall skill, this specific chunk’s actual purpose is materially different from the declared skill purpose, so this should be flagged as a mismatch.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Data stays local. New installs use `~/.awaek/data/awaek.db`; existing Hermes installs may keep using `~/.hermes/awaek/data/awaek.db`.
- X access is handled by the local `xurl` CLI.
- Never read, print, summarize, upload, or inspect `~/.xurl`.
- Never ask the user to paste X Client IDs, Client Secrets, access tokens, refresh tokens, or `~/.xurl` contents into chat.
- Do not run `xurl` with verbose/debug flags.
- Retrieve focused evidence only. Do not send the full database to the model.
- If saved evidence is weak or missing, say so plainly.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Data stays local. New installs use `~/.awaek/data/awaek.db`; existing Hermes installs may keep using `~/.hermes/awaek/data/awaek.db`.
- X access is handled by the local `xurl` CLI.
- Never read, print, summarize, upload, or inspect `~/.xurl`.
- Never ask the user to paste X Client IDs, Client Secrets, access tokens, refresh tokens, or `~/.xurl` contents into chat.
- Do not run `xurl` with verbose/debug flags.
- Retrieve focused evidence only. Do not send the full database to the model.
- If saved evidence is weak or missing, say so plainly.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
OpenClaw ships an official `xurl` skill:
https://github.com/openclaw/openclaw/blob/main/skills/xurl/SKILL.md
If you use OpenClaw with Grok, set up the xAI provider here:
The skill invokes local Python scripts and the external xurl CLI, which implies file access to local databases and outbound network access to X APIs, yet it declares no explicit tool scope or permissions. This increases the risk of over-broad execution in agent environments because reviewers and runtime policy engines cannot easily constrain what the skill is allowed to access.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Data stays local. New installs use `~/.awaek/data/awaek.db`; existing Hermes installs may keep using `~/.hermes/awaek/data/awaek.db`.
- X access is handled by the local `xurl` CLI.
- Never read, print, summarize, upload, or inspect `~/.xurl`.
- Never ask the user to paste X Client IDs, Client Secrets, access tokens, refresh tokens, or `~/.xurl` contents into chat.
- Do not run `xurl` with verbose/debug flags.
- Retrieve focused evidence only. Do not send the full database to the model.
- If saved evidence is weak or missing, say so plainly.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Data stays local. New installs use `~/.awaek/data/awaek.db`; existing Hermes installs may keep using `~/.hermes/awaek/data/awaek.db`.
- X access is handled by the local `xurl` CLI.
- Never read, print, summarize, upload, or inspect `~/.xurl`.
- Never ask the user to paste X Client IDs, Client Secrets, access tokens, refresh tokens, or `~/.xurl` contents into chat.
- Do not run `xurl` with verbose/debug flags.
- Retrieve focused evidence only. Do not send the full database to the model.
- If saved evidence is weak or missing, say so plainly.
The skill declares broad trigger phrases such as 'my saves', 'my bookmarks', and 'saved X bookmarks', which are common conversational terms and can cause unintended invocation. In an agent setting, accidental routing to this skill could expose or process a user's local bookmark corpus when they did not intend to use this capability, creating a privacy and data-minimization risk.
The code creates a user data directory and opens a persistent database under ~/.awaek/data, and later stores bookmark text, author metadata, links, and raw JSON. There is no confirmation prompt, user-facing notice, or explanatory comment/docstring in this file warning that personal bookmark content will be persisted locally.
This function writes bookmark text, URLs, author information, timestamps, and serialized raw JSON into the database, which can include sensitive personal or account-derived data. The operation is silent in this file: there is no print/log message, confirmation, or inline warning explaining the persistence behavior.
The README instructs users to fetch and execute a remote shell script directly from the network using curl piped to bash. If the upstream repository, distribution path, or network path is compromised, arbitrary code will run immediately on the user's machine with the user's privileges.
Install xurl:
curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash
Check X authentication:
This code performs a persistent write by calling db.upsert_bookmarks(bookmarks), but the script provides no prior confirmation prompt or explicit disclosure that running it will modify local stored bookmark data. For a code file, persistent data writes should have some visible warning unless clearly disclosed as part of the operation.
No suspicious patterns detected.