Raindrop CLI
ReviewAudited by ClawScan on May 1, 2026.
Overview
The skill is purpose-aligned for managing Raindrop bookmarks, but users should notice that it relies on a personal Raindrop token and references a CLI script that is not included in the submitted artifacts.
Before installing, make sure you trust and can inspect the actual `raindrop` command that will run, store RAINDROP_TOKEN securely, and review any update or remove action before allowing it to change your bookmarks.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An incorrect URL or bookmark ID could cause the agent to modify or remove the wrong bookmark.
The documented commands can create, edit, or delete bookmarks in the user's Raindrop account; this is expected for the skill's purpose but should be used deliberately.
`raindrop add <url> --tags tag1,tag2 --collection unsorted` ... `raindrop update <id> --title "New title"` ... `raindrop remove <id>`
Confirm the target URL, collection, or bookmark ID before using update or remove operations.
Anyone who obtains the token may be able to access or change the user's Raindrop bookmarks, depending on the token's permissions.
The skill requires a personal Raindrop API token, which is expected for this integration but grants account access and should be protected.
Set `RAINDROP_TOKEN` in a local env file (recommended: `~/.config/openclaw/gateway.env`, chmod 600).
Store the token only in a protected local file, use the least-privileged token available, and rotate it if it may have been exposed.
The skill documentation may not be enough to verify what executable will actually run if a `raindrop` command exists elsewhere on the system.
The artifact manifest contains only SKILL.md and no included `scripts/raindrop` implementation or install spec, so the referenced command's implementation is not present in the submitted artifacts.
This skill provides `scripts/raindrop`.
Verify the provenance and contents of the `raindrop` command before giving it a Raindrop token.