Url Bookmarker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:34 AM UTC
• Version: 1.0.1

Overview

This bookmark skill is mostly straightforward, but its HTML and CSV exports can produce unsafe files from saved bookmark data.

Install only if you are comfortable with a local bookmark store and user-directed deletion. Treat HTML and CSV exports as sensitive files, and avoid opening exported HTML or CSV in a browser or spreadsheet if any bookmark title, URL, tag, or folder came from an untrusted source until the exporter is hardened with proper escaping and CSV handling.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bookmark_manager.py:116

Finding

Stored HTML Injection in Bookmark Export

Content

View full analysis

Vulnerability Details

File Location: scripts/bookmark_manager.py, lines 116-120
Vulnerability Type: Stored HTML injection caused by unescaped bookmark data
Risk Level: Medium

Vulnerable Code

python

elif fmt == "html":
    lines = ["<html><body><ul>"]
    for b in data["urls"]:
        lines.append(f'<li><a href="{b["url"]}">{b["title"]}</a></li>')
    lines.append("</ul></body></html>")
    print("\n".join(lines))

Technical Analysis

The HTML exporter inserts the stored URL and title directly into an HTML attribute and text context without context-appropriate escaping. Both values can originate from command-line input supplied to the add command.

An attacker-controlled title can inject HTML elements because characters such as <, >, &, and quotes are preserved. A crafted URL can contain a quote that terminates the href attribute and introduces additional attributes or markup. Prefix normalization to http:// or https:// does not prevent attribute injection because the remainder of the string is not parsed or validated as a well-formed URL.

The vulnerability becomes exploitable when the generated output is saved as an HTML document and opened in a browser or rendered by another HTML consumer.

Attack Path

1. An attacker persuades the user to add a bookmark containing a malicious title or crafted URL.
2. The add command stores the value in assets/bookmarks.json without HTML-specific validation.
3. The user runs bookmark_manager.py export html.
4. The exporter embeds the malicious value directly into the generated markup.
5. The user saves or redirects the output to an HTML file and opens it in a browser.
6. The injected markup or event-handler content executes or alters the rendered document.

Impact Assessment

Exploitation can modify the exported document, create deceptive links or forms, and execute browser-side script in the generated document's lo ...[truncated 260 chars]

Remediation

View remediation

Remediation Suggestions

• Escape titles with html.escape(title, quote=True) before inserting them into HTML text.
• Escape URL attribute values with html.escape(url, quote=True).
• Parse URLs with a standard URL parser and accept only well-formed http and https URLs.
• Reject control characters and malformed authority or host components.
• Prefer a trusted HTML templating mechanism with automatic contextual escaping.
• Add tests covering titles and URLs containing quotes, angle brackets, ampersands, event-handler fragments, and line breaks.

Example hardening:

python

import html
from urllib.parse import urlparse

parsed = urlparse(b["url"])
if parsed.scheme not in {"http", "https"} or not parsed.netloc:
    raise ValueError("Invalid bookmark URL")

safe_url = html.escape(b["url"], quote=True)
safe_title = html.escape(b["title"], quote=True)
lines.append(f'<li><a href="{safe_url}">{safe_title}</a></li>')

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bookmark_manager.py:121

Finding

CSV Formula Injection and Improper CSV Escaping

Content

View full analysis

Vulnerability Details

File Location: scripts/bookmark_manager.py, lines 121-125
Vulnerability Type: Spreadsheet formula injection and malformed CSV generation
Risk Level: Medium

Vulnerable Code

python

elif fmt == "csv":
    print("title,url,tags,folder,added")
    for b in data["urls"]:
        print(f'"{b["title"]}","{b["url"]}","{",".join(b["tags"])}","{b.get("folder","")}","{b["added"]}"')

Technical Analysis

The exporter manually wraps fields in double quotes but does not escape embedded double quotes, carriage returns, or newlines according to CSV rules. Consequently, attacker-controlled bookmark fields can corrupt the record structure or introduce additional cells and rows.

In addition, spreadsheet applications may interpret cells beginning with =, +, -, or @ as formulas. Titles, tags, and folders are accepted from command-line input and exported without neutralizing dangerous formula prefixes. A malicious value can therefore become an active formula when the CSV is opened in a compatible spreadsheet application.

Using syntactically valid CSV quoting alone does not prevent formula injection; structural CSV escaping and spreadsheet-specific formula neutralization are both required.

Attack Path

1. An attacker supplies or recommends a bookmark whose title, tag, or folder begins with a spreadsheet formula marker, or contains quotes and line breaks designed to alter CSV structure.
2. The user adds the bookmark, causing the value to be stored in assets/bookmarks.json.
3. The user runs bookmark_manager.py export csv and saves the output.
4. The user opens the exported file in a spreadsheet application.
5. The application interprets the attacker-controlled cell as a formula or processes the injected CSV structure.
6. Subject to the spreadsheet application's capabilities and security settings, the formula may display deceptive content, initiate external requests, disclo ...[truncated 605 chars]

Remediation

View remediation

Remediation Suggestions

• Replace manual string construction with Python's csv.writer, using sys.stdout with appropriate newline handling.
• Before export, neutralize values whose first non-whitespace character is =, +, -, or @, for example by prefixing an apostrophe.
• Apply the protection consistently to every user-controlled field, including titles, URLs, tags, and folders.
• Reject or normalize control characters where multiline field support is unnecessary.
• Document whether CSV output is intended for machine interchange or spreadsheet import, because spreadsheet-safe transformations may modify displayed values.
• Add tests for commas, embedded quotes, CR/LF characters, Unicode text, and all common formula prefixes.

Example hardening:

python

import csv

def spreadsheet_safe(value):
    value = str(value)
    if value.lstrip().startswith(("=", "+", "-", "@")):
        return "'" + value
    return value

writer = csv.writer(sys.stdout)
writer.writerow(["title", "url", "tags", "folder", "added"])
for b in data["urls"]:
    writer.writerow([
        spreadsheet_safe(b["title"]),
        spreadsheet_safe(b["url"]),
        spreadsheet_safe(",".join(b["tags"])),
        spreadsheet_safe(b.get("folder", "")),
        spreadsheet_safe(b["added"]),
    ])

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents and implies local file read/write behavior via JSON storage and export, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency problem: an agent or reviewer cannot easily determine the intended filesystem access boundary, increasing the chance of overbroad file operations or unsafe integration behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes a bookmark remove <url> command, which deletes user data from the local bookmark store, but it provides no warning that the action removes saved bookmarks or may be irreversible. Under the markdown-specific warning criterion, destructive behavior affecting user data should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill description documents exporting bookmarks to JSON, HTML, or CSV, but does not warn that saved URLs, titles, tags, and folders will be written out to a file. For markdown skill descriptions, behaviors that affect user data or privacy should include a user-facing warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.