Security audit

Bookmarks

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent bookmark organizer, but it directs silent background imports from connected platforms into persistent local files with limited upfront user control.

Review this before installing if your saved items are private. Only connect sources you want indexed, confirm whether imports happen per-source or all at once, and decide where the local ~/bookmarks/ data should live and how it can be deleted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill repeatedly instructs silent import of data from connected platforms without prominently warning users that their saved content will be collected and processed in the background. This creates a meaningful privacy risk because users may not understand the scope, timing, or persistence of cross-platform data aggregation.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger condition 'Only surface when useful or asked' is vague and grants the skill broad discretion to activate based on inferred usefulness rather than explicit user intent. In a background-importing skill, this ambiguity can lead to unexpected resurfacing of private saved content or unsolicited context injection into unrelated interactions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill creates and maintains files under '~/bookmarks/' but does not clearly warn users that local artifacts containing potentially sensitive browsing interests and saved links will be written to disk. These files may persist longer than expected, be accessible to other local processes or users depending on system configuration, and expand the user's privacy exposure.

Static analysis

No suspicious patterns detected.