Bookmark Intelligence

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:41 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent bookmark-analysis purpose, but it handles password-like X cookies and remote bookmark content through unsafe shell commands and includes under-scoped payment and background-running behavior.

Review this skill carefully before installing. It asks you to paste X session cookies that can access your account, runs a background daemon if enabled, fetches arbitrary bookmarked links, and currently uses unsafe shell command construction around cookies and remote URLs. Do not run it with privileged accounts, do not use it on sensitive networks, and treat the payment/crypto features as unfinished and not independently verified.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.js:176
• Finding: Shell Command Injection Through X Authentication Cookies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.js:176-184`; `monitor.js:72-76` **Vulnerability Type**: Shell command injection through untrusted credential interpolation **Risk Level**: Critical ### Vulnerable Code ```js // scripts/setup.js async function testCredentials(authToken, ct0) { printHeader('🧪 Testing Credentials'); print('Verifying your credentials with X...', yellow); try { // Test with bird whoami const cmd = `AUTH_TOKEN="${authToken}" CT0="${ct0}" bird whoami --json 2>&1`; const result = execSync(cmd, { encoding: 'utf8', timeout: 15000 }); ``` ```js // monitor.js function fetchBookmarks() { console.log(`[${new Date().toISOString()}] Fetching bookmarks...`); try { // Use environment variables for credentials (safer than command line args) const cmd = `AUTH_TOKEN="${credentials.auth_token}" CT0="${credentials.ct0}" bird bookmarks -n ${config.bookmarkCount} --json`; const output = execSync(cmd, { encoding: 'utf8', maxBuffer: 10 * 1024 * 1024 }); ``` ### Technical Analysis Both authentication cookie values are placed inside command strings passed to `execSync()`. By default, `execSync()` invokes a system shell. Double quotation marks do not make this construction safe because a malicious value can contain a closing quotation mark followed by shell metacharacters or command substitutions. The setup wizard accepts these values directly from terminal input. The monitor later reads them from `.env` or inherited environment variables. Therefore, compromise of either input channel can produce shell execution. The comment that environment variables are safer than command-line arguments is misleading in this implementation: the variables are assigned through shell syntax rather than through the child-process `env` option. ### Attack Path 1. An attacker persuades a user to paste a crafted cookie value, or modifies the local `.env` file. 2. The value contains syntax that terminates the quoted s ...[truncated 801 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace shell command strings with `execFileSync()` or `spawnSync()` and explicit argument arrays. - Supply cookies through the child process environment without invoking a shell: ```js const result = execFileSync( 'bird', ['whoami', '--json'], { encoding: 'utf8', timeout: 15000, env: { ...process.env, AUTH_TOKEN: authToken, CT0: ct0 } } ); ``` - Apply the same change to `monitor.js`. - Validate `bookmarkCount` as a bounded integer before passing it to the child process. - Do not log full command strings, credentials, or child-process environments. - Treat `.env` modification as a security-sensitive event and preserve owner-only permissions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: analyzer.js:16
• Finding: Command Injection and Server-Side Request Forgery Through Bookmark URLs<![CDATA[ ## Vulnerability Details **File Location**: `analyzer.js:16-38`; invocation at `analyzer.js:224-230` **Vulnerability Type**: Shell injection and unrestricted URL retrieval **Risk Level**: Critical ### Vulnerable Code ```js // Extract URLs from tweet text function extractUrls(text) { const urlRegex = /https?:\/\/[^\s]+/g; const matches = text.match(urlRegex) || []; return matches; } // Fetch full content from URLs function fetchUrlContent(url) { console.error(`Fetching content from: ${url}`); // Skip t.co URLs - they're just redirects if (url.includes('t.co')) { return null; } try { // Use curl with user agent to avoid blocks, limit content size const cmd = `curl -L -s -A "Mozilla/5.0" --max-time 10 "${url}" | head -c 100000`; const content = execSync(cmd, { encoding: 'utf8', timeout: 15000 }); ``` ```js for (const url of urls.slice(0, 3)) { // Limit to 3 URLs to avoid timeouts const content = fetchUrlContent(url); if (content && content.length > 100) { urlContents.push(`URL: ${url}\nContent: ${content}`); } } ``` ### Technical Analysis The URL originates in bookmark text and is interpolated into a shell command. A quotation mark or command substitution inside the extracted URL can escape the intended `curl` argument and execute shell commands. Independently, the application follows redirects with `curl -L` and does not reject loopback, link-local, private-network, or cloud metadata destinations. The `http` or `https` prefix requirement does not prevent requests to internal HTTP services. Skipping URLs containing `t.co` does not mitigate either issue. It is a substring check rather than a destination security policy, and redirects from any other public hostname can still reach an internal address. ### Attack Path 1. An attacker publishes content containing a specially constructed URL, or otherwise causes such a URL to appear in bookmark text. 2. The user bookmarks the content. 3. `monitor.js` retriev ...[truncated 986 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove shell-based `curl` invocation and use a maintained native HTTP client. - Parse URLs with the platform `URL` class and allow only `http:` and `https:`. - Resolve destination hostnames before connecting. - Reject loopback, private, link-local, multicast, unspecified, and cloud metadata address ranges for both IPv4 and IPv6. - Revalidate the destination after every redirect; do not rely on the initial hostname. - Consider an explicit hostname allowlist if arbitrary article retrieval is unnecessary. - Limit redirects, response size, decompressed size, content type, and request duration. - Disable proxy inheritance unless explicitly required and trusted. - Keep fetched remote data out of sensitive execution contexts. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: analyzer.js:49
• Finding: Untrusted Remote Content Is Inserted Directly Into an LLM Instruction Prompt<![CDATA[ ## Vulnerability Details **File Location**: `analyzer.js:49-83`; `analyzer.js:231-238` **Vulnerability Type**: Indirect prompt injection through tweets and fetched web content **Risk Level**: High ### Vulnerable Code ```js function buildAnalysisPrompt(bookmark, urlContents) { const contextProjects = config.contextProjects.join(', '); let contentSection = ''; if (urlContents.length > 0) { contentSection = `\n**Referenced Content:**\n${urlContents.join('\n\n---\n\n')}`; } return `Analyze this bookmarked content and extract actionable insights. **Tweet:** Author: @${bookmark.author.username} (${bookmark.author.name}) Text: ${bookmark.text} Engagement: ${bookmark.likeCount} likes, ${bookmark.retweetCount} retweets Posted: ${bookmark.createdAt} ${contentSection} **Context Projects:** ${contextProjects} **Extract:** 1. **Key Concepts**: Main ideas, technologies, patterns mentioned 2. **Actionable Items**: Specific code snippets, strategies, tools, or techniques that can be implemented 3. **Implementation Suggestions**: How these could be applied to the context projects 4. **Relevance**: Which context projects this relates to and why 5. **Priority**: High/Medium/Low based on potential impact and relevance `; } ``` ```js const prompt = buildAnalysisPrompt(bookmark, urlContents); // Get LLM analysis (or fallback) const analysis = callLLM(prompt, bookmark); ``` ### Technical Analysis Tweet text and fetched article content are untrusted. They are concatenated into the same text block as the model's operational instructions, without structured role separation or a clear statement that instructions found in the content must be ignored. A remote author can include text that appears to be a higher-priority instruction, requests alternative output, fabricates JSON fields, or attempts to induce disclosure of contextual information. The current implementation relies on the model to infer which text is data and which text is an instruction. Alt ...[truncated 1231 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Submit remote content using structured message roles rather than concatenating it with system or developer instructions. - Clearly delimit remote data and state that instructions, policies, commands, and requests inside it are untrusted content that must not be followed. - Run analysis with no filesystem, shell, messaging, network, or secret-bearing tools unless strictly necessary. - Validate the response against a strict JSON schema, including allowed enum values, field sizes, and array limits. - Treat generated actionable items as untrusted suggestions requiring user confirmation. - Consider a two-stage process: first extract inert facts from remote content, then analyze only the validated structured facts. - Do not expose unrelated conversation history, credentials, or private project data to this model call. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:196
• Finding: Unpinned Global Installation of an Ambiguous Credential-Handling Dependency<) - **bird CLI** - X/Twitter command-line tool ```bash npm install -g bird ``` ### Optional (but recommended) - **PM2** - For running as a background daemon ```bash npm install -g pm2 ``` ``` ```js const deps = [ { name: 'bird', command: 'bird', installCmd: 'npm install -g bird', required: true }, { name: 'pm2', command: 'pm2', installCmd: 'npm install -g pm2', required: false }, { name: 'node', command: 'node', installCmd: 'Visit https://nodejs.org', required: true } ]; ``` The README identifies the tool using a GitHub link while the installation command resolves an unscoped registry name: ```markdown - [bird CLI](https://github.com/yardencsGitHub/bird) (`npm install -g bird`) ``` ### Technical Analysis The instructions install mutable, unpinned packages globally. No package version, integrity hash, publisher identity, lockfile, or provenance requirement is provided. The `bird` tool is especially security-sensitive because the Skill passes password-equivalent X cookies to it. Linking to a GitHub repository does not guarantee that the unscoped npm package name resolves to code from that repository. Global installation also increases scope: package lifecycle scripts and installed executables run outside a project-local dependency boundary. ### Attack Path 1. A user follows the documented `npm install -g bird` instruction. 2. The registry resolves the mutable unscoped package name at its current version. 3. If the package is malicious, compromised, abandoned, or unrelated to the linked repository, its installation scripts or executable run locally. 4. The setup and monitor processes pass `AUTH_TOKEN` and `CT0` to th ...[truncated 496 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Identify the exact expected package, publisher, repository, and package registry. - Pin a reviewed version rather than installing the latest mutable release. - Verify package provenance, signatures, and integrity hashes. - Prefer a project-local dependency recorded in a lockfile over global installation. - Remove the tool entirely if X access can be implemented through a narrowly scoped, audited API client. - Do not provide password-equivalent cookies to a third-party executable unless its code and release provenance have been reviewed. - Pin and review PM2 as well, even though it does not receive the cookies directly through its configuration. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: analyzer.js:112
• Finding: Predictable Temporary Prompt Files Permit Disclosure and File-Race Attacks<![CDATA[ ## Vulnerability Details **File Location**: `analyzer.js:112-133` **Vulnerability Type**: Insecure temporary-file creation and cleanup **Risk Level**: High ### Vulnerable Code ```js try { // Write prompt to temp file const tempFile = `/tmp/bookmark-analysis-${Date.now()}.txt`; writeFileSync(tempFile, prompt); // Try to use openclaw CLI to invoke LLM // This assumes openclaw command is available and configured // For MVP, we'll use fallback since openclaw might not have 'ask' command const cmd = `openclaw ask --model gpt-4o-mini --format json "$(cat ${tempFile})" 2>/dev/null || echo '{"error": "LLM unavailable"}'`; const result = execSync(cmd, { encoding: 'utf8', timeout: 60000, maxBuffer: 10 * 1024 * 1024 }); // Clean up temp file try { execSync(`rm ${tempFile}`); } catch (e) {} ``` ### Technical Analysis The filename uses only the current timestamp and is created in a shared temporary directory. It is not opened with exclusive creation flags and no explicit owner-only mode is specified. An attacker with local access can predict likely names and race file creation. Depending on filesystem protections, a pre-created symbolic link could cause `writeFileSync()` to overwrite another file writable by the Skill user. The file can also be read if the resulting permissions permit access to other local users. The prompt includes tweet data, fetched article text, and the user's project context. Cleanup occurs only after successful command completion and uses another shell command. Exceptions before cleanup leave the file behind. ### Attack Path 1. A local attacker predicts the timestamp-based path. 2. The attacker monitors `/tmp` or repeatedly creates candidate files or symbolic links. 3. The analyzer calls `writeFileSync()` on the predictable path. 4. The attacker reads the prompt or redirects the write through a symbolic link. 5. If the OpenClaw call fails or times out, the prompt file may remain on disk. ### ...[truncated 315 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Avoid a temporary file entirely; provide the prompt to the child process through standard input. - Invoke OpenClaw with `execFileSync()` or `spawnSync()` rather than shell substitution. - If a file is unavoidable, create a private directory with `mkdtempSync()`. - Create the file with exclusive flags and mode `0600`. - Use an unpredictable cryptographic filename. - Delete files with `unlinkSync()` in a `finally` block rather than invoking `rm`. - Ensure that error, timeout, and signal paths all perform cleanup. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/license.js:155
• Finding: Paid Licenses and Payment Completion Can Be Forged Locally<![CDATA[ ## Vulnerability Details **File Location**: `scripts/license.js:155-185`; `scripts/payment.js:208-239`; CLI exposure at `scripts/payment.js:364-382` **Vulnerability Type**: Missing license signature validation and missing payment verification **Risk Level**: High ### Vulnerable Code ```js export function validateLicenseKey(key) { // Check test licenses if (TEST_LICENSES[key]) { return TEST_LICENSES[key]; } // License format: TIER-XXXXXXXXXXXXXXXXXXXXXXXX (32 chars hex after tier) const match = key.match(/^(FREE|PRO|ENT)-([0-9A-F]{24})$/); if (!match) { return null; } const tierPrefix = match[1]; const signature = match[2]; const tierMap = { 'FREE': 'free', 'PRO': 'pro', 'ENT': 'enterprise' }; const tier = tierMap[tierPrefix]; if (!tier) { return null; } // In production, you would verify the signature against your server // For MVP, we just validate format return { tier, valid: true }; } ``` ```js export function completePayment(paymentId, method = null, metadata = {}) { const db = loadPaymentsDB(); const payment = db.payments.find(p => p.id === paymentId); if (!payment) { return { success: false, error: 'Payment not found' }; } if (payment.status === 'completed') { return { success: false, error: 'Payment already completed', licenseKey: payment.licenseKey }; } // Generate license key const licenseKey = generateLicenseKey(payment.tier); // Update payment record payment.status = 'completed'; payment.completedAt = new Date().toISOString(); payment.licenseKey = licenseKey; payment.expiresAt = expiresAt.toISOString(); payment.metadata = metadata; savePaymentsDB(db); ``` ```js case 'complete': const paymentId = process.argv[3]; const email3 = process.argv[4] || '[e-mail]'; if (!paymentId) { console.error('Usage: node payment.js complete <payment-id> [email]'); process.exit(1); } const completeResult = completePayment(paym ...[truncated 1579 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Sign license claims using a private signing key held outside the distributed package. - Verify licenses using a public key embedded in the client and a standard signature algorithm. - Include the tier, customer identifier, issuance time, expiration time, and unique license identifier in the signed claims. - Remove publicly documented production test licenses or ensure they work only in an explicit development build. - Create Stripe Checkout sessions through Stripe's authenticated API. - Complete Stripe payments only after verifying a signed webhook and matching the expected session, amount, currency, customer, and payment status. - For crypto, verify transaction destination, token contract, amount, chain, confirmation count, and uniqueness before completion. - Restrict manual completion to authenticated administrative workflows with an audit log. - Protect payment databases and license records with owner-only permissions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/withdraw.cjs:10
• Finding: Cryptocurrency Withdrawal Destination Is Hardcoded to a Bundled Third-Party Address<![CDATA[ ## Vulnerability Details **File Location**: `scripts/withdraw.cjs:10-34`; bundled addresses at `payment-config.json:2-10` **Vulnerability Type**: Hardcoded financial destination and unsafe future transfer design **Risk Level**: High ### Vulnerable Code ```js const CONFIG_PATH = path.join(__dirname, '../payment-config.json'); const TRUST_WALLET = '0x544E033D055738e7b5c40AD4318B506e1219E064'; async function withdraw(destinationAddress, amount, token, chain) { // Load config const config = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')); // SECURITY CHECK: Only allow Trust Wallet if (destinationAddress.toLowerCase() !== TRUST_WALLET.toLowerCase()) { throw new Error(`❌ SECURITY VIOLATION: Withdrawals only allowed to Trust Wallet (${TRUST_WALLET}). Attempted: ${destinationAddress}`); } console.log('✅ Security check passed: Destination is Trust Wallet'); console.log(`\n📤 Withdrawal Request:`); console.log(` Token: ${token}`); console.log(` Amount: ${amount}`); console.log(` Chain: ${chain}`); console.log(` From: ${config.crypto.revenueWallet}`); console.log(` To: ${destinationAddress}`); // TODO: Implement actual blockchain transfer // This would use the crypto-wallet skill to execute the transfer console.log('\n⚠️ Actual transfer not yet implemented.'); console.log('This is a safeguard placeholder - would execute transfer via crypto-wallet skill.'); ``` ```json { "crypto": { "enabled": true, "acceptedTokens": ["USDT", "USDC"], "acceptedChains": ["polygon", "bsc", "ethereum", "arbitrum", "optimism", "base"], "revenueWallet": "0xE03e679cEf0ACa49eaDFaF333e3fF45cCD6b0818", "trustWallet": "0x544E033D055738e7b5c40AD4318B506e1219E064", "withdrawalPolicy": "trust-wallet-only", "confirmations": 2, "notes": "Revenue sweeps only to authorized Trust Wallet" } } ``` ### Technical Analysis The withdrawal function accepts a destination argument but rejects every address except th ...[truncated 1780 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove every publisher-specific wallet address from the distributed package. - Disable payment functionality by default. - Require the installer to configure the receiving and withdrawal addresses explicitly. - Do not override the caller's selected destination with a compiled-in address. - Display the checksummed destination, chain, token contract, and amount and require explicit confirmation before signing. - Separate payment collection from withdrawals and apply least-privilege wallet permissions. - Resolve the payment configuration schema mismatch and reject incomplete configurations. - Add automated tests proving that no package-controlled destination can replace an installer-controlled destination. - Obtain an independent review before integrating any real wallet or signing capability. ]]>

other

Warning

• Location: scripts/license.js:57
• Finding: Unnecessary Machine Fingerprinting Combined With Weak XOR Obfuscation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/license.js:57-117`; storage use at `scripts/license.js:121-148` **Vulnerability Type**: Environment fingerprinting and ineffective protection of license data **Risk Level**: Medium ### Vulnerable Code ```js function getMachineId() { try { // Try multiple methods for cross-platform support let machineId = null; // Linux: use machine-id if (process.platform === 'linux') { try { machineId = execSync('cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id', { encoding: 'utf8' }).trim(); } catch (e) {} } // macOS: use IOPlatformUUID if (!machineId && process.platform === 'darwin') { try { machineId = execSync('ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID', { encoding: 'utf8' }) .split('=')[1].trim().replace(/"/g, ''); } catch (e) {} } // Windows: use WMIC if (!machineId && process.platform === 'win32') { try { machineId = execSync('wmic csproduct get uuid', { encoding: 'utf8' }).split('\n')[1].trim(); } catch (e) {} } // Fallback: use hostname if (!machineId) { machineId = execSync('hostname', { encoding: 'utf8' }).trim(); } return crypto.createHash('sha256').update(machineId).digest('hex').substring(0, 32); } catch (error) { return 'default-machine-id-00000000'; } } ``` ```js function xorEncrypt(text, key) { const keyBuffer = Buffer.from(key); const textBuffer = Buffer.from(text); const result = Buffer.alloc(textBuffer.length); for (let i = 0; i < textBuffer.length; i++) { result[i] = textBuffer[i] ^ keyBuffer[i % keyBuffer.length]; } return result.toString('base64'); } function xorDecrypt(encrypted, key) { const keyBuffer = Buffer.from(key); const encryptedBuffer = Buffer.from(encrypted, 'base64'); const result = Buffer.alloc(encryptedBuffer.length); for (let i = 0; i < encryptedBuffer.length; i++) { ...[truncated 1544 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove machine fingerprinting unless a documented, necessary licensing requirement justifies it. - Use digitally signed license claims for authenticity instead of reversible local encryption. - If local confidentiality is required, store secrets through the operating system's credential manager. - Use an authenticated encryption construction such as AES-GCM with a securely generated and protected key. - Apply owner-only permissions to license and usage files. - Validate parsed license objects against a strict schema. - Do not describe XOR/Base64 storage as encryption in security documentation. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (79)

Credential Access

High

• Category: Privilege Escalation

Content

logs/

# Credentials (user must provide their own)
.env
config.json

# License and payment data (sensitive)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup
npm run verify

• Confidence: 97% confidence
• Finding: The command `rm -rf ../../life/resources/bookmarks/*` performs recursive deletion on a relative path outside the current skill directory. Relative destructive paths are risky because users may run them from an unexpected location or with modified directory layouts, causing unintended data loss beyond the intended bookmark cache.

Credential Access

High

• Category: Privilege Escalation

Content

## For Existing Users (Updating)

### If You Already Have .env and config.json
```bash
cd skills/bookmark-intelligence
git pull  # or however you update

• Confidence: 90% confidence
• Finding: The documentation normalizes retaining credentials in a local .env file for updates, reinforcing a pattern where high-value auth material is stored on disk. In the context of browser-derived tokens, compromise of the workstation, backups, or accidental commits could expose live account access.

Credential Access

High

• Category: Privilege Escalation

Content

```
skills/bookmark-intelligence/
├── .env                  # ← Your credentials (SECRET!)
├── config.json           # ← Your preferences
├── bookmarks.json        # ← Processing state (auto-created)
└── [other skill files]

• Confidence: 94% confidence
• Finding: The file layout explicitly identifies .env as containing 'Your credentials', confirming that the skill expects sensitive authentication material to be stored locally in plaintext. Since the same guide also references extracted browser cookies, these secrets likely provide direct session access, making local disclosure highly impactful.

Credential Access

High

• Category: Privilege Escalation

Content

### "Missing credentials" error after setup
```bash
# Check .env exists and has content
cat .env

# Should show:

• Confidence: 95% confidence
• Finding: The troubleshooting instructions tell users to inspect the .env file directly, encouraging direct handling of plaintext secrets. This increases the risk of shoulder-surfing, terminal logging, shell history capture, or accidental sharing of credential contents during support interactions.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: analyzer.js:37

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: monitor.js:76

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/license.js:65

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/setup.js:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/uninstall.js:43