Link Brain

PassAudited by ClawScan on May 10, 2026.

Overview

Link Brain appears to be a local bookmark knowledge-base tool, but it can bulk-import browser bookmarks and fetch user-supplied URLs, so users should only index content they are comfortable storing locally.

This skill looks suitable if you want a local bookmark knowledge base. Before running quickstart, know that it may import all detected browser bookmarks into ~/.link-brain. Use manual setup or a custom LINK_BRAIN_DIR if you want more control, and avoid auto-saving private URLs or file:// paths unless you want their contents indexed.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your existing browser bookmarks may be indexed and retained locally, not just links you manually save.

Why it was flagged

Quickstart can bulk-copy browser bookmarks into a persistent local knowledge base. This matches the skill purpose, but bookmarks can reveal private interests and browsing patterns.

Skill content
Scans Chrome, Safari, and Firefox for bookmarks ... Imports everything it finds ... Data lives in `~/.link-brain/`.
Recommendation

Use setup or scan first if you want to review what will be imported, and delete unwanted entries or the ~/.link-brain directory if you do not want the data retained.

What this means

Saving a link with auto-save can make a network request to that URL and store derived metadata locally.

Why it was flagged

Auto-save fetches user-supplied URLs to summarize and tag them. This is disclosed and central to the feature, but it still means the agent may access external or internal URLs if asked.

Skill content
`python3 scripts/brain.py auto-save "https://example.com"` ... This is the only command that makes a network request.
Recommendation

Only use auto-save for URLs you intend the agent to fetch; avoid private intranet, localhost, or sensitive URLs unless that is deliberate.

What this means

If a local file URL is saved with --auto, content from that file may be copied into the Link Brain database or returned in command output.

Why it was flagged

The test suite shows auto-save can process file:// URLs, meaning local file content can be read and summarized when such a URL is supplied.

Skill content
FILE_URL="file://$HTML_PATH" ... OUT_AUTO_SAVE="$(python3 "$BRAIN" save "$FILE_URL" --auto)"
Recommendation

Do not auto-save file:// links unless you intend to index that local file; a future hardening improvement would be to restrict schemes to http/https unless explicitly enabled.