Linkding

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:15 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Linkding bookmark manager, but it gives an agent full token-backed read/write/delete access with weak guardrails around destructive actions and credential transport.

Install only if you are comfortable giving the agent broad access to your Linkding account. Use HTTPS only, protect the credentials file with restrictive permissions, avoid shared machines for this token, and require the agent to show the target bookmark or bundle and get explicit confirmation before any delete operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/linkding-api.sh:10

Finding

API Token Can Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/linkding-api.sh, lines 10–35
Vulnerability Type: Insufficient transport security validation
Risk Level: Medium

bash

if [[ -f "$CONFIG_FILE" ]]; then
    LINKDING_URL=$(jq -r '.url // empty' "$CONFIG_FILE")
    LINKDING_API_KEY=$(jq -r '.apiKey // empty' "$CONFIG_FILE")
fi

LINKDING_URL="${LINKDING_URL:-}"
LINKDING_API_KEY="${LINKDING_API_KEY:-}"

if [[ -z "$LINKDING_URL" || -z "$LINKDING_API_KEY" ]]; then
    echo "Error: LINKDING_URL and LINKDING_API_KEY must be set (via env or $CONFIG_FILE)" >&2
    exit 1
fi

# Remove trailing slash
LINKDING_URL="${LINKDING_URL%/}"

api_call() {
    local method="$1"
    local endpoint="$2"
    shift 2
    
    curl -sS -X "$method" \
        -H "Authorization: Token $LINKDING_API_KEY" \
        -H "Content-Type: application/json" \
        "$@" \
        "${LINKDING_URL}${endpoint}"
}

Technical Analysis

The server URL is taken directly from the configuration file or environment without validating its scheme. Although the documentation examples use HTTPS, the implementation accepts an http:// URL and sends the API token in an Authorization header to that endpoint.

When HTTP is used, neither the token nor the request and response data receive transport-layer confidentiality or integrity protection. Linkding data may include private URLs, descriptions, notes, tags, and account profile information.

The configurable endpoint is legitimate because Linkding is self-hosted, but accepting plaintext remote endpoints by default is not necessary for the Skill's declared functionality.

Attack Path

1. A user, deployment script, or attacker with configuration influence sets LINKDING_URL or the configured url field to an http:// endpoint.
2. The user or Agent invokes any command, such as bookmarks, create, or profile.
3. The script sends `Authorization: Token <API_ ...[truncated 679 chars]

Remediation

View remediation

Remediation Suggestions

• Parse and validate LINKDING_URL before making a request.
• Require the https scheme by default and reject unsupported schemes.
• If HTTP support is needed for local development, require an explicit opt-in and restrict it to loopback addresses such as 127.0.0.1, ::1, or a clearly documented trusted environment.
• Do not silently downgrade HTTPS or disable certificate validation.
• Document that production and remote Linkding instances must use HTTPS with a valid certificate.
• Consider validating that the URL contains no embedded credentials, fragments, or unexpected control characters.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/linkding-api.sh:30

Finding

API Token Is Included in Curl Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/linkding-api.sh, lines 30–35
Vulnerability Type: Sensitive information exposure through process arguments
Risk Level: Low

bash

api_call() {
    local method="$1"
    local endpoint="$2"
    shift 2
    
    curl -sS -X "$method" \
        -H "Authorization: Token $LINKDING_API_KEY" \
        -H "Content-Type: application/json" \
        "$@" \
        "${LINKDING_URL}${endpoint}"
}

Technical Analysis

The API token is expanded into the -H command-line argument supplied to curl. On systems where process arguments are visible to other users or monitoring services, the authorization header may appear in process listings or process inspection interfaces while the request is active.

Exploitability depends on operating-system process visibility controls, local permissions, request duration, and whether an attacker can continuously monitor newly created processes. The token is not printed by the script itself, but placing it in argv creates avoidable local exposure.

Attack Path

1. An attacker obtains local process-inspection access on the same host.
2. The attacker monitors process creation or repeatedly reads process argument data.
3. A user or Agent invokes an authenticated Linkding command.
4. The attacker observes the curl argument containing Authorization: Token ....
5. The attacker extracts and reuses the token against the configured Linkding service.

Impact Assessment

Successful exploitation exposes the Linkding API token to a local attacker with adequate process visibility. The attacker could exercise the token's Linkding privileges, potentially reading private bookmark information and modifying or deleting bookmarks, tags, and bundles.

This issue does not directly grant operating-system privilege escalation. Its scope is the Linkding account and resources authorized by the disclosed token.

Remediation

View remediation

Remediation Suggestions

• Avoid placing authorization headers directly in command-line arguments.
• Supply sensitive curl configuration through a protected file descriptor or a temporary curl configuration file with mode 0600.
• If a temporary file is used, create it securely with mktemp, set a restrictive umask, install an EXIT trap, and remove the file after use.
• Ensure secrets are not included in debugging output, shell tracing, logs, or error diagnostics.
• Where supported by the deployment environment, isolate the process so unrelated local users cannot inspect its arguments.

T09 · Insecure Skill Coding Practices

Note

• Location: README.md:22

Finding

Credential Setup Does Not Enforce Owner-Only File Permissions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 22–26
Vulnerability Type: Insecure credential-file permission guidance
Risk Level: Low

bash

mkdir -p ~/.clawdbot/credentials/linkding
cp config.json.example ~/.clawdbot/credentials/linkding/config.json
# Edit with your actual values

Technical Analysis

The documented setup creates a directory and copies a file that will contain a long-lived Linkding API token, but it does not explicitly apply owner-only permissions. The resulting permissions depend on the user's umask, existing directory permissions, and source-file mode.

On a system with a permissive umask or an already accessible credentials directory, the configuration may be readable by other local users. Accessing a dedicated Linkding credential file is necessary for the Skill's declared functionality, but leaving its protection to ambient defaults is avoidable.

The referenced config.json.example file is also absent from the audited package. That is a packaging defect, but it does not itself create the credential exposure.

Attack Path

1. A user follows the documented setup on a multi-user system with permissive file-creation defaults.
2. The resulting directory or config.json is group-readable or world-readable.
3. The user places the Linkding URL and API token in the file.
4. Another local user reads the configuration file.
5. The attacker reuses the token to access the Linkding API.

Impact Assessment

Exposure grants the attacker the Linkding privileges associated with the token. This may include reading private bookmarks and notes and creating, changing, archiving, or deleting Linkding resources.

The vulnerability does not provide direct system privilege escalation. It affects confidentiality and integrity within the configured Linkding account.

Remediation

View remediation

Remediation Suggestions

Replace the setup commands with permission-enforcing operations, for example:

bash

install -d -m 700 "$HOME/.clawdbot/credentials/linkding"
install -m 600 config.json.example \
  "$HOME/.clawdbot/credentials/linkding/config.json"

Additionally:

• Document that the configuration contains a secret and must not be committed to source control.
• Recommend a restrictive umask, such as umask 077, before creating the file.
• At runtime, inspect the credential file's ownership and permissions and warn or fail if it is accessible by group or other users.
• Add the referenced example file to the package without a real token, or update the instructions to create the file manually.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/linkding-api.sh (reported line 206)May include surrounding context.

sh

}

cmd_delete() {
    api_call DELETE "/api/bookmarks/${1}/"
}

cmd_tags() {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/linkding-api.sh (reported line 327)May include surrounding context.

sh

}

cmd_bundle_delete() {
    api_call DELETE "/api/bundles/${1}/"
}

cmd_profile() {

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 8)May include surrounding context.

md

## What It Does

- **Bookmarks** — list, search, create, update, archive, delete
- **Tags** — list and create tags
- **Bundles** — saved searches with filters
- **Check URLs** — see if a link is already bookmarked

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill documents shell-based capabilities but does not declare any explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and can allow the agent runtime to invoke broader shell functionality than is necessary for simple bookmark management, increasing the blast radius if the skill is misused or prompt-injected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: linkding
version: 1.0.1
description: Manage bookmarks with Linkding. Use when the user asks to "save a bookmark", "add link", "search bookmarks", "list my bookmarks", "find saved links", "tag a bookmark", "archive bookmark", "check if URL is saved", "list tags", "create bundle", or mentions Linkding bookmark management.
---

# Linkding Bookmark Manager

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes a delete operation without any warning, confirmation requirement, or guidance to verify user intent. In an agent setting, ambiguous user requests, prompt injection, or operator error could trigger irreversible bookmark deletion and cause loss of user data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI supports deletion of bookmarks and bundles, but the manifest description does not disclose destructive deletion capability. Hidden destructive actions are dangerous because an agent or user may invoke the skill assuming it only manages or archives bookmarks, resulting in irreversible data loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script exposes a profile command that retrieves user profile/preferences, but the skill description is limited to bookmark-management tasks. This broadens the tool's effective privilege surface beyond what a user would reasonably expect, increasing the risk of unintended access to account metadata through prompt/tool misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Bookmark deletion is executed immediately with no confirmation, dry-run, or secondary authorization step. In an agent context, this makes prompt injection, misunderstanding, or parameter mistakes materially more dangerous because a single tool call can permanently remove data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup instructions tell users to place a long-lived API token in a local JSON file and also suggest exporting it via environment variables, but they do not warn that these are sensitive secrets. This increases the chance of accidental exposure through shell history, world-readable files, backups, screenshots, or process/environment leakage, especially in agent-driven environments where logs and command context may be persisted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file documents archive, unarchive, and delete commands, including a direct delete example at L095, but provides no warning that these actions modify or remove user data. For markdown files, the skill description should disclose behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.