Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Raindrop.io API helper, but users should be careful with bulk edits, deletes, exports, backups, and tokens.
Install only if you want help working with Raindrop.io APIs or MCP. Treat access tokens and client secrets as sensitive, review any bulk update/delete/export action before running it, and store downloaded exports or backups carefully because they may contain private bookmark data.
The invocation text says to use the skill when the user mentions broad terms like 'tags', 'filters', or 'connect an app, script, or AI client', which are common across many domains and not specific enough on their own to Raindrop.io. Although some trigger terms are specific, the overall activation condition lacks clear constraints or negative examples, increasing the risk of unintended invocation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Quick Start
- Developer docs: `https://developer.raindrop.io/`
- REST API base: `https://api.raindrop.io/rest/v1`
- MCP endpoint: `https://api.raindrop.io/rest/v2/ai/mcp`
- Request format:
- Non-POST requests accept URL-encoded parameters.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Quick Start
- Developer docs: `https://developer.raindrop.io/`
- REST API base: `https://api.raindrop.io/rest/v1`
- MCP endpoint: `https://api.raindrop.io/rest/v2/ai/mcp`
- Request format:
- Non-POST requests accept URL-encoded parameters.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Quick Start
- Developer docs: `https://developer.raindrop.io/`
- REST API base: `https://api.raindrop.io/rest/v1`
- MCP endpoint: `https://api.raindrop.io/rest/v2/ai/mcp`
- Request format:
- Non-POST requests accept URL-encoded parameters.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Quick Start
- Developer docs: `https://developer.raindrop.io/`
- REST API base: `https://api.raindrop.io/rest/v1`
- MCP endpoint: `https://api.raindrop.io/rest/v2/ai/mcp`
- Request format:
- Non-POST requests accept URL-encoded parameters.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Quick Start
- Developer docs: `https://developer.raindrop.io/`
- REST API base: `https://api.raindrop.io/rest/v1`
- MCP endpoint: `https://api.raindrop.io/rest/v2/ai/mcp`
- Request format:
- Non-POST requests accept URL-encoded parameters.
This markdown file lists creating, updating, deleting, emptying, merging, and bulk-removing collections as supported uses, but provides no warning that these actions can alter or permanently remove user data. Under the markdown variant of SQP-2, skill descriptions should disclose behaviors that may affect user data or system integrity.
The document states that the API can update or delete bookmarks and perform bulk updates or deletes, but it does not warn users that these operations can change or remove saved content at scale. For markdown files, omission of warnings about behaviors affecting user data is in scope for SQP-2.
The export and backups sections explain how to export all raindrops or download backup files, which can expose large amounts of personal bookmark data outside the service. The description lacks a user-facing warning about handling exported archives carefully because they may contain sensitive data.
No suspicious patterns detected.