Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent bookmark organizer, but it directs silent background imports from connected platforms into persistent local files with limited upfront user control.
Review this before installing if your saved items are private. Only connect sources you want indexed, confirm whether imports happen per-source or all at once, and decide where the local ~/bookmarks/ data should live and how it can be deleted.
The skill repeatedly instructs silent import of data from connected platforms without prominently warning users that their saved content will be collected and processed in the background. This creates a meaningful privacy risk because users may not understand the scope, timing, or persistence of cross-platform data aggregation.
The trigger condition 'Only surface when useful or asked' is vague and grants the skill broad discretion to activate based on inferred usefulness rather than explicit user intent. In a background-importing skill, this ambiguity can lead to unexpected resurfacing of private saved content or unsolicited context injection into unrelated interactions.
The skill creates and maintains files under '~/bookmarks/' but does not clearly warn users that local artifacts containing potentially sensitive browsing interests and saved links will be written to disk. These files may persist longer than expected, be accessible to other local processes or users depending on system configuration, and expand the user's privacy exposure.
No suspicious patterns detected.
