T09 · Insecure Skill Coding Practices
Warning
- Location
references/timeliness.md:61- Finding
Bookmark URLs Disclosed to a Third-Party Content Service Without Explicit Per-Use Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Pinboard Manager
Security checks for vulnerabilities and agentic risk
Overview
This Pinboard management skill is mostly purpose-aligned, but it handles sensitive bookmark data and account-changing actions with several under-scoped privacy and safety risks.
Install only if you are comfortable giving the agent Pinboard API authority to read, modify, and delete bookmarks. Before running dead-link or timeliness modes, review the URL set, exclude private/internal/signed URLs, avoid bulk deletion without an export backup, and treat /tmp/pinboard_all.json as sensitive data that should be stored in a private per-user location instead.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/dead-link.md:9- Finding
Arbitrary Bookmark Fetching Permits Server-Side Request Forgery Against Local and Internal Services
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/tag-audit.md:5- Finding
Predictable Shared Temporary File Enables Symlink Overwrite, Cache Poisoning, and Bookmark Data Exposure
- Content
View full analysis
/tmp/pinboard_all.json ``` The timeliness workflow subsequently trusts the same fixed path: ```bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi ``` ### Technical Analysis The Skill uses the globally predictable path `/tmp/pinboard_all.json` for sensitive Pinboard data. It does not securely create the file, validate its owner, verify that it is a regular file, set restrictive permissions, or use a per-user directory. Shell output redirection follows symbolic links. A local attacker who can write to `/tmp` may create `/tmp/pinboard_all.json` as a symbolic link to another file writable by the Skill's user. When the Skill fetches bookmarks, the shell can overwrite the symlink target. A local attacker can also create a regular file at the expected location. The timeliness workflow checks only whether the file exists. Despite the comment referring to stale files, no age or integrity check is implemented. Attacker-supplied JSON may therefore be trusted as bookmark data and influence which URLs are fetched or which modifications are recommended. The cache may include bookmark URLs, titles, notes, tags, timestamps, and visibility-related fields. Depending on the process umask and operating-system configuration, this information may be accessible to other local users. ### Attack Path #### Symlink overwrite 1. A local attacker predicts the fixed path `/tmp/pinboard_all.json`. 2. The attacker creates a symbol ...[truncated 1445 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:68- Finding
Pinboard API Token and Private Bookmark Metadata Exposed Through Command-Line Query Parameters
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is scoped as the default for essentially any Pinboard-related request, including broad phrases like 'manage their Pinboard account in any way' and 'invoke immediately.' Overly broad activation increases the chance the agent will invoke a capability-bearing skill in contexts the user did not clearly intend, expanding exposure to account-wide read, update, and delete operations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 79% confidence
- Finding
The update example places the authentication token directly in the URL query string while sending bookmark content externally. Query-string secrets can be exposed through shell history, process listings, logs, proxies, or error reporting, making credential leakage more likely even though the destination service is legitimate.
- Content
CRITICAL: Always pass ALL fields to avoid data loss. The
/posts/addendpoint overwrites the entire bookmark.bash curl -s "https://api.pinboard.in/v1/posts/add?auth_token=$PINBOARD_AUTH_TOKEN&format=json&url=ENCODED_URL&description=ENCODED_TITLE&extended=ENCODED_NOTES&tags=ENCODED_TAGS&shared=ORIGINAL_SHARED&toread=ORIGINAL_TOREAD&replace=yes"Required fields to preserve:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document includes a direct bookmark deletion API call but does not state, in that section, that deletion requires explicit user confirmation or warn that it is destructive. In a skill that can operate over an entire bookmark corpus, omission of a clear confirmation guard raises the risk of accidental or over-broad deletion actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
The delete example also embeds the Pinboard auth token in the query string, compounding credential exposure risk for a destructive operation. If the token leaks, an attacker could read, modify, or delete the user's bookmarks through the Pinboard API.
- Content
Delete a bookmark
bash curl -s "https://api.pinboard.in/v1/posts/delete?auth_token=$PINBOARD_AUTH_TOKEN&format=json&url=ENCODED_URL"Rate limiting
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions direct the agent to probe every bookmarked URL with HEAD/GET requests but do not warn that this will generate outbound traffic to all saved sites. That can disclose the user's bookmark corpus to third parties, trigger tracking or rate limits, and contact internal or sensitive URLs if such bookmarks exist. In a bookmark-management skill, automatic network access is contextually relevant, but the lack of explicit user warning/confirmation still makes it risky.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow includes permanent deletion through the Pinboard API but does not prominently warn that applying decisions will irreversibly remove bookmarks. Without an explicit confirmation step and clear notice of permanence, an agent could carry out destructive actions the user did not fully understand or intend. In this skill, deletion is a legitimate feature, but silent or weakly signaled destructive capability increases the chance of harmful mistakes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This skill instructs fetching the user's entire Pinboard bookmark corpus, including titles, URLs, notes, tags, and metadata, from an external service and storing it in a world-accessible temporary path under /tmp. Even though Pinboard is the intended service, this is still an external transmission of potentially sensitive user data and increases exposure through broad collection and insecure local handling.
- Content
Step 1: Fetch all bookmarks
bash curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.jsonParse the JSON and count total bookmarks.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This step sends bookmark content back to Pinboard via a GET request containing the auth token, URL, title, notes, tags, and other metadata in the query string. Query parameters may be exposed in logs, shell history, process listings, proxies, or monitoring systems, so sensitive bookmark data and credentials can leak during normal operation.
- Content
bash # URL-encode all parameters curl -s "https://api.pinboard.in/v1/posts/add?auth_token=$PINBOARD_AUTH_TOKEN&format=json&url=ENCODED_URL&description=ENCODED_TITLE&extended=ENCODED_NOTES&tags=NEW_TAGS&shared=ORIGINAL_SHARED&toread=ORIGINAL_TOREAD&replace=yes" sleep 3 # Rate limit
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L005 states "All tags in English, lowercase," which imposes a language policy in natural language. Under the policy rules, forcing a specific language without user opt-in or a clearly documented justification is a reportable violation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Only fetch if cache doesn't exist or is stale if [ ! -f /tmp/pinboard_all.json ]; then curl -s "https://api.pinboard.in/v1/posts/all?auth_token=$PINBOARD_AUTH_TOKEN&format=json" > /tmp/pinboard_all.json fi
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill sends each candidate bookmark URL to Jina Reader, a third-party service, and may also transmit page content derived from the user's private bookmark collection without any explicit privacy warning or consent gate. In the context of Pinboard management, bookmarked URLs can reveal sensitive interests, internal resources, work systems, or private notes context, so this data exposure is materially risky beyond normal API usage.
- Content
Static analysis
No suspicious patterns detected.