X Bookmark Triage

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If enabled, the skill can automatically clear bookmarks from your X account; mistakes may be hard to undo from X itself.

Why it was flagged

The scheduled poller deletes/unbookmarks X bookmarks after triage, and also deletes already-seen items, without a per-bookmark confirmation step.

Skill content

if (bookmark.tweetId && userId) { const deleted = deleteBookmark(accessToken, userId, bookmark.tweetId);

Recommendation

Use a dry run or read-only OAuth scope first, and only grant bookmark.write if you are comfortable with automatic unbookmarking.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

A user relying on registry metadata may not realize this skill needs tokens that can read and modify X bookmarks, post to Discord, and spend Anthropic API quota.

Why it was flagged

The registry metadata does not declare credentials, while the README and scripts require multiple sensitive credentials for X, Discord, and Anthropic.

Skill content

Required env vars: none; Primary credential: none

Recommendation

Declare all required environment variables and credentials in the package metadata, and document the minimum safe scopes clearly.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Granting write scope lets the skill remove bookmarks from your X account.

Why it was flagged

The requested X OAuth scopes are directly related to reading and optionally removing bookmarks, but bookmark.write is a powerful account permission.

Skill content

Needs `bookmark.read` scope (+ `bookmark.write` to auto-unbookmark).

Recommendation

Prefer bookmark.read-only mode unless you specifically want the cleanup behavior.

NoteHigh Confidence

ASI10: Rogue Agents

What this means

Once scheduled, the skill may repeatedly read Discord messages or X bookmarks and post cards without a fresh prompt each time.

Why it was flagged

The skill documents recurring background polling via cron/launchd/systemd. This is disclosed and purpose-aligned, but it means the skill can keep acting after setup.

Skill content

Schedule polling ... */2 * * * * cd /path/to/x-bookmark-triage && bash scripts/run-poll.sh

Recommendation

Only enable the scheduler after testing manually, and keep clear unload/disable instructions handy.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Untrusted web content can influence the generated knowledge card that may later be treated as part of your knowledge base.

Why it was flagged

Fetched tweet or web-page content is sent into the LLM prompt and then summarized into persistent Discord knowledge cards.

Skill content

Content:\n${fetched.content.slice(0, 6000)}

Recommendation

Treat generated cards as summaries of untrusted content and review important cards before relying on them.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Anyone who can post in the watched Discord channel may trigger URL triage and cause content to be sent to Anthropic and posted back to Discord.

Why it was flagged

The Discord poller reads channel messages and processes URLs from non-bot users in that channel.

Skill content

const messages = fetchMessages(state.last_message_id);

Recommendation

Restrict the watched channel to trusted users and use a dedicated Discord bot with minimal permissions.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users may follow setup instructions for a file that is absent or must be supplied from elsewhere.

Why it was flagged

The documentation references a launchd plist template that is not listed in the provided file manifest.

Skill content

Edit scripts/ai.watson.knowledge-intake-poll.plist

Recommendation

Include the referenced template in the package or update the documentation to avoid setup ambiguity.

Findings (5)

critical

suspicious.dangerous_exec

Location: scripts/backlog-sweep.js:70
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: scripts/bookmark-poll.js:65
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: scripts/poll-channel.js:48
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: scripts/triage-url.js:72
Finding: Shell command execution detected (child_process).

critical

suspicious.exposed_secret_literal

Location: scripts/x-oauth2-authorize.js:138
Finding: File appears to expose a hardcoded API secret or token.