ClawHub
Back to skill

Security audit

X Bookmarks Archiver

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims: fetch X bookmarks, archive them locally, and optionally use OpenAI to summarize them.

Install only if you are comfortable allowing the bird CLI to read bookmarks from the X account it is authenticated to. Leave OPENAI_API_KEY unset if you do not want bookmark URLs and tweet text sent to OpenAI, and review the generated X-knowledge files and state directory if your bookmarks include sensitive personal or work links.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script reads OPENAI_API_KEY from the environment and sends bookmark URLs and tweet text to an external OpenAI-compatible API. That network access is functionally related to the feature ('Generate title, summary, and tags using AI'), but it still creates a real data-exposure risk because potentially sensitive user content is transmitted off-host using credentials without strong consent or minimization controls.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The script discovers a workspace outside its own directory and writes generated markdown into that external OpenClaw workspace path. Even though this appears intended for bookmark archival, cross-workspace writes can modify user data in unexpected locations and increase the blast radius if bookmark content or categorization logic is abused.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documentation says it generates AI summaries using OpenAI and marks the API key as optional, but it does not clearly disclose that bookmark content, linked URLs/metadata, and potentially tweet text may be transmitted to a third-party model provider for processing. This creates a privacy and data-handling risk because users may archive sensitive or private bookmarks without understanding that their content could leave the local environment.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Bookmark URLs and associated tweet text are transmitted to a third-party AI API, but the script provides no explicit user-facing warning or consent flow before doing so. This is dangerous because bookmarked content may contain private, sensitive, or regulated information that the user may not expect to leave the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
}`;

  try {
    const result = await fetch('https://api.openai.com/v1/chat/completions', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${apiKey}`,
Confidence
90% confidence
Finding
fetch('https://api.openai.com/v1/chat/completions', { method: 'POST'

External Transmission

Medium
Category
Data Exfiltration
Content
}`;

  try {
    const result = await fetch('https://api.openai.com/v1/chat/completions', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${apiKey}`,
Confidence
90% confidence
Finding
https://api.openai.com/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/fetch.cjs:18

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/run.cjs:18

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/test-all.cjs:26

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/process.cjs:21

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
tests/fixtures/sample-bookmarks.json:4