Bookmark Intelligence

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:41 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent bookmark-analysis purpose, but it handles password-like X cookies and remote bookmark content through unsafe shell commands and includes under-scoped payment and background-running behavior.

Review this skill carefully before installing. It asks you to paste X session cookies that can access your account, runs a background daemon if enabled, fetches arbitrary bookmarked links, and currently uses unsafe shell command construction around cookies and remote URLs. Do not run it with privileged accounts, do not use it on sensitive networks, and treat the payment/crypto features as unfinished and not independently verified.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.js:176

Finding

Shell Command Injection Through X Authentication Cookies

Content

View full analysis

&1`; const result = execSync(cmd, { encoding: 'utf8', timeout: 15000 }); ``` ```js // monitor.js function fetchBookmarks() { console.log(`[${new Date().toISOString()}] Fetching bookmarks...`); try { // Use environment variables for credentials (safer than command line args) const cmd = `AUTH_TOKEN="${credentials.auth_token}" CT0="${credentials.ct0}" bird bookmarks -n ${config.bookmarkCount} --json`; const output = execSync(cmd, { encoding: 'utf8', maxBuffer: 10 * 1024 * 1024 }); ``` ### Technical Analysis Both authentication cookie values are placed inside command strings passed to `execSync()`. By default, `execSync()` invokes a system shell. Double quotation marks do not make this construction safe because a malicious value can contain a closing quotation mark followed by shell metacharacters or command substitutions. The setup wizard accepts these values directly from terminal input. The monitor later reads them from `.env` or inherited environment variables. Therefore, compromise of either input channel can produce shell execution. The comment that environment variables are safer than command-line arguments is misleading in this implementation: the variables are assigned through shell syntax rather than through the child-process `env` option. ### Attack Path 1. An attacker persuades a user to paste a crafted cookie value, or modifies the local `.env` file. 2. The value contains syntax that terminates the quoted s ...[truncated 801 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: analyzer.js:16

Finding

Command Injection and Server-Side Request Forgery Through Bookmark URLs

Content

View full analysis

100) { urlContents.push(`URL: ${url}\nContent: ${content}`); } } ``` ### Technical Analysis The URL originates in bookmark text and is interpolated into a shell command. A quotation mark or command substitution inside the extracted URL can escape the intended `curl` argument and execute shell commands. Independently, the application follows redirects with `curl -L` and does not reject loopback, link-local, private-network, or cloud metadata destinations. The `http` or `https` prefix requirement does not prevent requests to internal HTTP services. Skipping URLs containing `t.co` does not mitigate either issue. It is a substring check rather than a destination security policy, and redirects from any other public hostname can still reach an internal address. ### Attack Path 1. An attacker publishes content containing a specially constructed URL, or otherwise causes such a URL to appear in bookmark text. 2. The user bookmarks the content. 3. `monitor.js` retriev ...[truncated 986 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: analyzer.js:49

Finding

Untrusted Remote Content Is Inserted Directly Into an LLM Instruction Prompt

Content

View full analysis

0) { contentSection = `\n**Referenced Content:**\n${urlContents.join('\n\n---\n\n')}`; } return `Analyze this bookmarked content and extract actionable insights. **Tweet:** Author: @${bookmark.author.username} (${bookmark.author.name}) Text: ${bookmark.text} Engagement: ${bookmark.likeCount} likes, ${bookmark.retweetCount} retweets Posted: ${bookmark.createdAt} ${contentSection} **Context Projects:** ${contextProjects} **Extract:** 1. **Key Concepts**: Main ideas, technologies, patterns mentioned 2. **Actionable Items**: Specific code snippets, strategies, tools, or techniques that can be implemented 3. **Implementation Suggestions**: How these could be applied to the context projects 4. **Relevance**: Which context projects this relates to and why 5. **Priority**: High/Medium/Low based on potential impact and relevance `; } ``` ```js const prompt = buildAnalysisPrompt(bookmark, urlContents); // Get LLM analysis (or fallback) const analysis = callLLM(prompt, bookmark); ``` ### Technical Analysis Tweet text and fetched article content are untrusted. They are concatenated into the same text block as the model's operational instructions, without structured role separation or a clear statement that instructions found in the content must be ignored. A remote author can include text that appears to be a higher-priority instruction, requests alternative output, fabricates JSON fields, or attempts to induce disclosure of contextual information. The current implementation relies on the model to infer which text is data and which text is an instruction. Alt ...[truncated 1231 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:196

Finding

Unpinned Global Installation of an Ambiguous Credential-Handling Dependency

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: analyzer.js:112

Finding

Predictable Temporary Prompt Files Permit Disclosure and File-Race Attacks

Content

View full analysis

/dev/null || echo '{"error": "LLM unavailable"}'`; const result = execSync(cmd, { encoding: 'utf8', timeout: 60000, maxBuffer: 10 * 1024 * 1024 }); // Clean up temp file try { execSync(`rm ${tempFile}`); } catch (e) {} ``` ### Technical Analysis The filename uses only the current timestamp and is created in a shared temporary directory. It is not opened with exclusive creation flags and no explicit owner-only mode is specified. An attacker with local access can predict likely names and race file creation. Depending on filesystem protections, a pre-created symbolic link could cause `writeFileSync()` to overwrite another file writable by the Skill user. The file can also be read if the resulting permissions permit access to other local users. The prompt includes tweet data, fetched article text, and the user's project context. Cleanup occurs only after successful command completion and uses another shell command. Exceptions before cleanup leave the file behind. ### Attack Path 1. A local attacker predicts the timestamp-based path. 2. The attacker monitors `/tmp` or repeatedly creates candidate files or symbolic links. 3. The analyzer calls `writeFileSync()` on the predictable path. 4. The attacker reads the prompt or redirects the write through a symbolic link. 5. If the OpenClaw call fails or times out, the prompt file may remain on disk. ### ...[truncated 315 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/license.js:155

Finding

Paid Licenses and Payment Completion Can Be Forged Locally

Content

View full analysis

p.id === paymentId); if (!payment) { return { success: false, error: 'Payment not found' }; } if (payment.status === 'completed') { return { success: false, error: 'Payment already completed', licenseKey: payment.licenseKey }; } // Generate license key const licenseKey = generateLicenseKey(payment.tier); // Update payment record payment.status = 'completed'; payment.completedAt = new Date().toISOString(); payment.licenseKey = licenseKey; payment.expiresAt = expiresAt.toISOString(); payment.metadata = metadata; savePaymentsDB(db); ``` ```js case 'complete': const paymentId = process.argv[3]; const email3 = process.argv[4] || '[e-mail]'; if (!paymentId) { console.error('Usage: node payment.js complete [email]'); process.exit(1); } const completeResult = completePayment(paym ...[truncated 1579 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/withdraw.cjs:10

Finding

Cryptocurrency Withdrawal Destination Is Hardcoded to a Bundled Third-Party Address

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: scripts/license.js:57

Finding

Unnecessary Machine Fingerprinting Combined With Weak XOR Obfuscation

Content

View full analysis

/dev/null || cat /var/lib/dbus/machine-id', { encoding: 'utf8' }).trim(); } catch (e) {} } // macOS: use IOPlatformUUID if (!machineId && process.platform === 'darwin') { try { machineId = execSync('ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID', { encoding: 'utf8' }) .split('=')[1].trim().replace(/"/g, ''); } catch (e) {} } // Windows: use WMIC if (!machineId && process.platform === 'win32') { try { machineId = execSync('wmic csproduct get uuid', { encoding: 'utf8' }).split('\n')[1].trim(); } catch (e) {} } // Fallback: use hostname if (!machineId) { machineId = execSync('hostname', { encoding: 'utf8' }).trim(); } return crypto.createHash('sha256').update(machineId).digest('hex').substring(0, 32); } catch (error) { return 'default-machine-id-00000000'; } } ``` ```js function xorEncrypt(text, key) { const keyBuffer = Buffer.from(key); const textBuffer = Buffer.from(text); const result = Buffer.alloc(textBuffer.length); for (let i = 0; i < textBuffer.length; i++) { result[i] = textBuffer[i] ^ keyBuffer[i % keyBuffer.length]; } return result.toString('base64'); } function xorDecrypt(encrypted, key) { const keyBuffer = Buffer.from(key); const encryptedBuffer = Buffer.from(encrypted, 'base64'); const result = Buffer.alloc(encryptedBuffer.length); for (let i = 0; i < encryptedBuffer.length; i++) { ...[truncated 1544 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (79)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 7)May include surrounding context.

text

logs/

# Credentials (user must provide their own)
.env
config.json

# License and payment data (sensitive)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAWHUB_CHECKLIST.md (reported line 10)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAWHUB_CHECKLIST.md (reported line 93)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PACKAGING_COMPLETE.md (reported line 45)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 12)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 23)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 26)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 180)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 232)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 233)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 234)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 276)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TESTING_CHECKLIST.md (reported line 279)May include surrounding context.

md

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · monitor.js (reported line 18)May include surrounding context.

js

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · monitor.js (reported line 21)May include surrounding context.

js

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · monitor.js (reported line 47)May include surrounding context.

js

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.js (reported line 144)May include surrounding context.

js

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.js (reported line 285)May include surrounding context.

js

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/uninstall.js (reported line 58)May include surrounding context.

js

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify-package.js (reported line 90)May include surrounding context.

js

cd skills/bookmark-intelligence

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The command rm -rf ../../life/resources/bookmarks/* performs recursive deletion on a relative path outside the current skill directory. Relative destructive paths are risky because users may run them from an unexpected location or with modified directory layouts, causing unintended data loss beyond the intended bookmark cache.

Content

Scanner excerpt · CLAWHUB_CHECKLIST.md (reported line 11)May include surrounding context.

md

# Remove all user-specific files
rm -f .env config.json bookmarks.json
rm -rf ../../life/resources/bookmarks/*

# Verify cleanup
npm run verify

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The documentation normalizes retaining credentials in a local .env file for updates, reinforcing a pattern where high-value auth material is stored on disk. In the context of browser-derived tokens, compromise of the workstation, backups, or accidental commits could expose live account access.

Content

Scanner excerpt · INSTALL.md (reported line 50)May include surrounding context.

For Existing Users (Updating)

If You Already Have .env and config.json

bash

cd skills/bookmark-intelligence
git pull  # or however you update

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The file layout explicitly identifies .env as containing 'Your credentials', confirming that the skill expects sensitive authentication material to be stored locally in plaintext. Since the same guide also references extracted browser cookies, these secrets likely provide direct session access, making local disclosure highly impactful.

Content

Scanner excerpt · INSTALL.md (reported line 85)May include surrounding context.

text

skills/bookmark-intelligence/
├── .env                  # ← Your credentials (SECRET!)
├── config.json           # ← Your preferences
├── bookmarks.json        # ← Processing state (auto-created)
└── [other skill files]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The troubleshooting instructions tell users to inspect the .env file directly, encouraging direct handling of plaintext secrets. This increases the risk of shoulder-surfing, terminal logging, shell history capture, or accidental sharing of credential contents during support interactions.

Content

Scanner excerpt · INSTALL.md (reported line 124)May include surrounding context.

"Missing credentials" error after setup

bash

# Check .env exists and has content
cat .env

# Should show:

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: analyzer.js:37

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: monitor.js:76

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/license.js:65

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/setup.js:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/uninstall.js:43