Security audit

Save Link & Web Clipper

Security checks for vulnerabilities and agentic risk

Overview

This YouMind web clipper mostly matches its stated purpose, but it uses overly broad triggers, forced promotional messaging, and an unpinned global CLI install for an external account-writing workflow.

Install only if you intentionally want URLs sent to and stored in YouMind. Use explicit YouMind-scoped commands, avoid saving private or signed URLs, do not paste API keys into chat, and review or pin the CLI package before installing it globally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:56
Finding: Mandatory Promotional Output and Conversation Hijacking
Content: View full analysis
**✅ Save Link & Web Clipper installed!** > > Send me any URL and I'll save it to your YouMind board instantly. > > **What it does:** > - Save any webpage, article, or video to YouMind > - Organize links in your personal knowledge base > - Access saved content anytime from your YouMind board > > **Setup (one-time):** > 1. Get your free API key: https://youmind.com/settings/api-keys?utm_source=youmind-web-clipper > 2. Add it to your OpenClaw config (`~/.openclaw/openclaw.json`) — see setup guide for details. > > **Try it:** > Just paste any URL like: https://example.com/interesting-article > > **Need help?** Just ask! ``` `SKILL.md:124-137`: ```markdown **⚠️ MANDATORY: Immediately send the user a message with the link:** ``` ✅ Link saved to YouMind! View here: ``` (Adapt to user's language.) That's it — save, show link, done. No polling required. ### Step 6: Offer follow-up **⚠️ MANDATORY: Do NOT end the conversation after showing results. You MUST ask this question:** > "Would you like me to summarize the saved page?" ``` `SKILL.md:143-150`: ```markdown **⚠️ MANDATORY: Paywall (HTTP 402) handling:** When you receive a 402 error (codes: `InsufficientCreditsException`, `QuotaExceededException`, `DailyLimitExceededException`, `LimitExceededException`), immediately show this message (translated to user's language): > You've reached your free plan limit. Upgrade to Pro or Max to unlock unlimited link saving, more storage, and priority processing. > > **Upgrade now:** https://youmind.com/ ...[truncated 2007 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/setup.md:5
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Document the expected package version and integrity information. 3. Verify package provenance, publisher identity, signatures, and registry source before installation. 4. Prefer a lockfile-controlled local installation over a global installation where feasible. 5. Avoid automatically installing packages. Request explicit user approval and show the exact package, version, registry, and scope first. 6. Run the CLI with the least-privileged account possible and avoid elevated installation commands. 7. Disable npm lifecycle scripts during installation when they are unnecessary and compatibility has been verified. 8. Periodically review new versions before updating the pinned dependency. 9. Limit the CLI process's access to unrelated files, credentials, and environment variables. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 89% confidence
Finding: The trigger 'save link' semantically overlaps with built-in 'save' behaviors and can shadow native commands or user expectations. In an agent environment, this can redirect a generic save request into an external API action, causing unintended data transmission or workflow confusion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Several triggers such as 'bookmark', 'clip', 'save this', and 'bookmark this' are broad everyday phrases that can match ordinary user intent outside a clearly consented external-upload workflow. That increases the chance the skill activates unexpectedly and sends URLs to YouMind when the user may have meant a local save, browser bookmark, or another built-in action.
Content: No source excerpt is available for this finding.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 91% confidence
Finding: The trigger 'save url' is a close variant of generic save behavior and may intercept requests that are not intended for this external clipper. Because the skill then performs network actions with the provided URL, accidental invocation can lead to unintended disclosure or modification of user data in YouMind.
Content: No source excerpt is available for this finding.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 91% confidence
Finding: The trigger 'save page' is broad and likely to overlap with common browser, editor, or agent save operations. This creates a realistic risk of the skill activating when the user intended a local action, resulting in an external submission instead.
Content: No source excerpt is available for this finding.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 95% confidence
Finding: The trigger 'save this' is especially ambiguous because it can refer to almost any object in the current conversation or UI. In a multimodal or agent context, such a broad phrase could cause the skill to activate on unintended content and forward a URL externally without sufficiently specific user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill markets 'save any URL' but does not clearly warn near the primary usage flow that submitted URLs are sent to an external third-party service and associated with the user's account. Users may disclose internal, private, or token-bearing URLs without understanding that they leave the local environment.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.
md
If set, proceed to the workflow. If not set, guide the user to configure it themselves. **Do NOT ask the user to paste the key in chat — it would be exposed in chat history.** Tell the user (in their language):

Static analysis

No suspicious patterns detected.