Linkding

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:15 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Linkding bookmark manager, but it gives an agent full token-backed read/write/delete access with weak guardrails around destructive actions and credential transport.

Install only if you are comfortable giving the agent broad access to your Linkding account. Use HTTPS only, protect the credentials file with restrictive permissions, avoid shared machines for this token, and require the agent to show the target bookmark or bundle and get explicit confirmation before any delete operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/linkding-api.sh:10
• Finding: API Token Can Be Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `scripts/linkding-api.sh`, lines 10–35 **Vulnerability Type**: Insufficient transport security validation **Risk Level**: Medium ```bash if [[ -f "$CONFIG_FILE" ]]; then LINKDING_URL=$(jq -r '.url // empty' "$CONFIG_FILE") LINKDING_API_KEY=$(jq -r '.apiKey // empty' "$CONFIG_FILE") fi LINKDING_URL="${LINKDING_URL:-}" LINKDING_API_KEY="${LINKDING_API_KEY:-}" if [[ -z "$LINKDING_URL" || -z "$LINKDING_API_KEY" ]]; then echo "Error: LINKDING_URL and LINKDING_API_KEY must be set (via env or $CONFIG_FILE)" >&2 exit 1 fi # Remove trailing slash LINKDING_URL="${LINKDING_URL%/}" api_call() { local method="$1" local endpoint="$2" shift 2 curl -sS -X "$method" \ -H "Authorization: Token $LINKDING_API_KEY" \ -H "Content-Type: application/json" \ "$@" \ "${LINKDING_URL}${endpoint}" } ``` ### Technical Analysis The server URL is taken directly from the configuration file or environment without validating its scheme. Although the documentation examples use HTTPS, the implementation accepts an `http://` URL and sends the API token in an `Authorization` header to that endpoint. When HTTP is used, neither the token nor the request and response data receive transport-layer confidentiality or integrity protection. Linkding data may include private URLs, descriptions, notes, tags, and account profile information. The configurable endpoint is legitimate because Linkding is self-hosted, but accepting plaintext remote endpoints by default is not necessary for the Skill's declared functionality. ### Attack Path 1. A user, deployment script, or attacker with configuration influence sets `LINKDING_URL` or the configured `url` field to an `http://` endpoint. 2. The user or Agent invokes any command, such as `bookmarks`, `create`, or `profile`. 3. The script sends `Authorization: Token <API_ ...[truncated 679 chars]
• Remediation: ## Remediation Suggestions - Parse and validate `LINKDING_URL` before making a request. - Require the `https` scheme by default and reject unsupported schemes. - If HTTP support is needed for local development, require an explicit opt-in and restrict it to loopback addresses such as `127.0.0.1`, `::1`, or a clearly documented trusted environment. - Do not silently downgrade HTTPS or disable certificate validation. - Document that production and remote Linkding instances must use HTTPS with a valid certificate. - Consider validating that the URL contains no embedded credentials, fragments, or unexpected control characters.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/linkding-api.sh:30
• Finding: API Token Is Included in Curl Process Arguments## Vulnerability Details **File Location**: `scripts/linkding-api.sh`, lines 30–35 **Vulnerability Type**: Sensitive information exposure through process arguments **Risk Level**: Low ```bash api_call() { local method="$1" local endpoint="$2" shift 2 curl -sS -X "$method" \ -H "Authorization: Token $LINKDING_API_KEY" \ -H "Content-Type: application/json" \ "$@" \ "${LINKDING_URL}${endpoint}" } ``` ### Technical Analysis The API token is expanded into the `-H` command-line argument supplied to `curl`. On systems where process arguments are visible to other users or monitoring services, the authorization header may appear in process listings or process inspection interfaces while the request is active. Exploitability depends on operating-system process visibility controls, local permissions, request duration, and whether an attacker can continuously monitor newly created processes. The token is not printed by the script itself, but placing it in `argv` creates avoidable local exposure. ### Attack Path 1. An attacker obtains local process-inspection access on the same host. 2. The attacker monitors process creation or repeatedly reads process argument data. 3. A user or Agent invokes an authenticated Linkding command. 4. The attacker observes the curl argument containing `Authorization: Token ...`. 5. The attacker extracts and reuses the token against the configured Linkding service. ### Impact Assessment Successful exploitation exposes the Linkding API token to a local attacker with adequate process visibility. The attacker could exercise the token's Linkding privileges, potentially reading private bookmark information and modifying or deleting bookmarks, tags, and bundles. This issue does not directly grant operating-system privilege escalation. Its scope is the Linkding account and resources authorized by the disclosed token.
• Remediation: ## Remediation Suggestions - Avoid placing authorization headers directly in command-line arguments. - Supply sensitive curl configuration through a protected file descriptor or a temporary curl configuration file with mode `0600`. - If a temporary file is used, create it securely with `mktemp`, set a restrictive `umask`, install an `EXIT` trap, and remove the file after use. - Ensure secrets are not included in debugging output, shell tracing, logs, or error diagnostics. - Where supported by the deployment environment, isolate the process so unrelated local users cannot inspect its arguments.

T09 · Insecure Skill Coding Practices

Note

• Location: README.md:22
• Finding: Credential Setup Does Not Enforce Owner-Only File Permissions## Vulnerability Details **File Location**: `README.md`, lines 22–26 **Vulnerability Type**: Insecure credential-file permission guidance **Risk Level**: Low ```bash mkdir -p ~/.clawdbot/credentials/linkding cp config.json.example ~/.clawdbot/credentials/linkding/config.json # Edit with your actual values ``` ### Technical Analysis The documented setup creates a directory and copies a file that will contain a long-lived Linkding API token, but it does not explicitly apply owner-only permissions. The resulting permissions depend on the user's umask, existing directory permissions, and source-file mode. On a system with a permissive umask or an already accessible credentials directory, the configuration may be readable by other local users. Accessing a dedicated Linkding credential file is necessary for the Skill's declared functionality, but leaving its protection to ambient defaults is avoidable. The referenced `config.json.example` file is also absent from the audited package. That is a packaging defect, but it does not itself create the credential exposure. ### Attack Path 1. A user follows the documented setup on a multi-user system with permissive file-creation defaults. 2. The resulting directory or `config.json` is group-readable or world-readable. 3. The user places the Linkding URL and API token in the file. 4. Another local user reads the configuration file. 5. The attacker reuses the token to access the Linkding API. ### Impact Assessment Exposure grants the attacker the Linkding privileges associated with the token. This may include reading private bookmarks and notes and creating, changing, archiving, or deleting Linkding resources. The vulnerability does not provide direct system privilege escalation. It affects confidentiality and integrity within the configured Linkding account.
• Remediation: ## Remediation Suggestions Replace the setup commands with permission-enforcing operations, for example: ```bash install -d -m 700 "$HOME/.clawdbot/credentials/linkding" install -m 600 config.json.example \ "$HOME/.clawdbot/credentials/linkding/config.json" ``` Additionally: - Document that the configuration contains a secret and must not be committed to source control. - Recommend a restrictive `umask`, such as `umask 077`, before creating the file. - At runtime, inspect the credential file's ownership and permissions and warn or fail if it is accessible by group or other users. - Add the referenced example file to the package without a real token, or update the instructions to create the file manually.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

}

cmd_delete() {
    api_call DELETE "/api/bookmarks/${1}/"
}

cmd_tags() {

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

}

cmd_bundle_delete() {
    api_call DELETE "/api/bundles/${1}/"
}

cmd_profile() {

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium

• Category: Rogue Agent

Content

## What It Does

- **Bookmarks** — list, search, create, update, archive, delete
- **Tags** — list and create tags
- **Bundles** — saved searches with filters
- **Check URLs** — see if a link is already bookmarked

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documents shell-based capabilities but does not declare any explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and can allow the agent runtime to invoke broader shell functionality than is necessary for simple bookmark management, increasing the blast radius if the skill is misused or prompt-injected.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: linkding
version: 1.0.1
description: Manage bookmarks with Linkding. Use when the user asks to "save a bookmark", "add link", "search bookmarks", "list my bookmarks", "find saved links", "tag a bookmark", "archive bookmark", "check if URL is saved", "list tags", "create bundle", or mentions Linkding bookmark management.
---

# Linkding Bookmark Manager

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill exposes a delete operation without any warning, confirmation requirement, or guidance to verify user intent. In an agent setting, ambiguous user requests, prompt injection, or operator error could trigger irreversible bookmark deletion and cause loss of user data.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI supports deletion of bookmarks and bundles, but the manifest description does not disclose destructive deletion capability. Hidden destructive actions are dangerous because an agent or user may invoke the skill assuming it only manages or archives bookmarks, resulting in irreversible data loss.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script exposes a `profile` command that retrieves user profile/preferences, but the skill description is limited to bookmark-management tasks. This broadens the tool's effective privilege surface beyond what a user would reasonably expect, increasing the risk of unintended access to account metadata through prompt/tool misuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Bookmark deletion is executed immediately with no confirmation, dry-run, or secondary authorization step. In an agent context, this makes prompt injection, misunderstanding, or parameter mistakes materially more dangerous because a single tool call can permanently remove data.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The setup instructions tell users to place a long-lived API token in a local JSON file and also suggest exporting it via environment variables, but they do not warn that these are sensitive secrets. This increases the chance of accidental exposure through shell history, world-readable files, backups, screenshots, or process/environment leakage, especially in agent-driven environments where logs and command context may be persisted.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file documents archive, unarchive, and delete commands, including a direct delete example at L095, but provides no warning that these actions modify or remove user data. For markdown files, the skill description should disclose behaviors that can affect user data or system integrity.

Static analysis

No suspicious patterns detected.