Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims: it connects to Runa to save and manage bookmarks, notes, and uploaded files, with no hidden local persistence or unrelated behavior found.
Install this only if you intend your selected URLs, notes, and uploaded PDFs/images to be sent to Runa, stored in your Runa account, and in some cases enriched or AI-processed. Avoid saving secrets or confidential documents unless Runa is an approved place for that data, and review delete actions carefully because the API documentation says deletion is permanent.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
---
## DELETE /v1/links/:id
Permanently delete a bookmark and its tags.
The trigger phrases are broad enough that the skill could activate on common language like 'save this' or 'find my saved', causing accidental transmission, modification, or deletion of user data in an external system. Because the skill can write, update, delete, and upload, overbroad invocation scope meaningfully raises the chance of unintended sensitive actions.
The skill description does not clearly warn that user-provided text, URLs, and uploaded files are sent to a third-party service for storage and enrichment. This undermines informed consent and can lead to unintended disclosure of sensitive notes, links, or documents.
The skill explicitly instructs the agent to read credentials from a local secrets file and environment variable. While using an API key is expected for this integration, directing the agent to access local secret material expands its credential-access capability and increases the blast radius if the skill is invoked unexpectedly or abused.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.onruna.com/v1/links \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "<URL>"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.onruna.com/v1/links \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "<URL>"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.onruna.com/v1/links \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "<URL>"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.onruna.com/v1/links \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "<URL>"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.onruna.com/v1/links \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "<URL>"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST https://api.onruna.com/v1/links \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "<URL>"}'
The endpoint use here is tied to saving arbitrary text to a third-party service, which carries meaningful privacy risk because users may paste sensitive notes or credentials. The context makes this more dangerous than generic outbound traffic because enrichment and storage are persistent and involve potentially high-sensitivity free text.
curl -s -X POST https://api.onruna.com/v1/links \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"text": "Some text content to save"}'
The endpoint use here is tied to saving arbitrary text to a third-party service, which carries meaningful privacy risk because users may paste sensitive notes or credentials. The context makes this more dangerous than generic outbound traffic because enrichment and storage are persistent and involve potentially high-sensitivity free text.
curl -s -X POST https://api.onruna.com/v1/links \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"text": "Some text content to save"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://api.onruna.com/v1/links/<id>" \
-H "Authorization: Bearer $RUNA_API_KEY"
Updating remote bookmark metadata/status is expected, but it is a mutating external action and the rules only require confirmation for deletion, not other writes. In combination with broad triggers, this increases the risk of unintended changes to user data stored in the third-party service.
curl -s -X PATCH "https://api.onruna.com/v1/links/<id>" \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"status": "archived"}'
The enrich-preview feature sends a URL to a third-party service even when the user may think they are only previewing content locally. Because this capability is omitted from the manifest, users may not understand that merely asking for a preview still transmits data externally.
curl -s -X POST https://api.onruna.com/v1/enrich \
-H "Authorization: Bearer $RUNA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "<URL>"}'
Uploading files to an external service creates substantial confidentiality risk because PDFs and images may contain personal, proprietary, or regulated data. The skill description does not prominently warn users that uploaded documents are transmitted and stored remotely, making accidental sensitive-data disclosure more likely.
curl -s -X POST https://api.onruna.com/v1/files \
-H "Authorization: Bearer $RUNA_API_KEY" \
-F "file=@/path/to/file.pdf"
This markdown file documents multiple endpoints that send URLs, text content, and uploaded files to a remote API for enrichment, storage, AI tagging, and background processing, but it does not include any warning about privacy or data-handling implications. Because the file is a markdown document and these behaviors can affect user data and system privacy, the omission fits the missing-warning criterion.
The DELETE endpoint states that it will permanently delete a bookmark and its tags, but the documentation provides no explicit warning or caution callout about irreversibility. For markdown files, destructive behaviors that can affect user data should be accompanied by a user-facing warning.
The manifest scopes the skill to saving, searching, listing, updating, deleting bookmarks/notes, and uploading files. The instructions also include POST /v1/enrich to fetch preview/enrichment data without saving, which is a distinct behavior not reflected in the manifest description or trigger guidance.
No suspicious patterns detected.