Security audit
wallabag
Security checks for vulnerabilities and agentic risk
Overview
The skill's code and runtime instructions are broadly consistent with a Wallabag API client, but the package metadata omits required environment variables and required binaries and the script's behavior (printing tokens, requiring jq/curl) isn't reflected in the registry claims — that mismatch is concerning and should be clarified before use.
Before installing, verify the skill's provenance (unknown source). Expect to provide WALLABAG_BASE_URL, WALLABAG_CLIENT_ID, WALLABAG_CLIENT_SECRET, WALLABAG_USERNAME, and WALLABAG_PASSWORD — the registry metadata currently fails to list these. Ensure your environment can safely hold those secrets (avoid shared shells/logging). Install curl and jq if you want tag manipulation to work. Be cautious: running the 'auth' subcommand will print the token JSON to stdout (which may end up in logs), potentially exposing access tokens; if you accept that, prefer running auth only in a secure session and avoid copying its stdout into persistent logs. Ask the author to update registry metadata to declare required env vars and to document that 'auth' prints the token and that jq and curl are required. If you do not trust the unknown owner or cannot safely provide account credentials, do not install or enable this skill.
SkillSpector findings are pending for this release.