Raindrop.io API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  0.1.0

Overview

This is a coherent Raindrop.io API helper, but live use can let an authorized agent read or change bookmark data.

Install this if you want help building Raindrop.io API or MCP integrations. For live use, provide only least-privilege credentials through a secure mechanism when possible, review any bulk delete, move, merge, export, backup, or sharing operation before execution, and revoke tokens or MCP access when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The skill explicitly says to ask the user for client credentials or a token for live API calls, but it does not warn about the sensitivity of those secrets or recommend safer handling. In an agent setting, this can normalize pasting bearer tokens or OAuth client secrets into chat, increasing the risk of credential exposure, replay, or misuse.

VirusTotal

66/66 vendors flagged this skill as clean.