Url Manager

• Outcome: Review
• Latest audit: Jul 22, 2026 · 9:28 AM UTC
• Version: 2.1.1

Overview

This skill is a remote bookmark manager, but it silently creates an account and stores an access token without user consent.

Install only if you are comfortable with an agent creating or reusing an account on ai.ocean94.com, uploading bookmark data there, storing an access token in your home directory, and sharing results through bearer-style links. Review or modify the setup flow to require explicit consent, secure token storage, and revocation before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to persist an authentication token in ~/.url-manager-token and reuse it across sessions, which expands the skill from transient URL management into local credential storage. That creates a durable secret on disk without any documented permission boundary, secure storage control, or user consent, so compromise of the local environment or later misuse by the agent could expose ongoing account access.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The declared purpose is bookmark and knowledge management, but the workflow also performs automatic account registration and stores reusable credentials locally. This is a scope expansion affecting identity and authentication data, and users may invoke the skill for simple link saving without realizing they are being enrolled into a remote service with persistent access state.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script exposes agent self-registration and magic-link generation capabilities that are not disclosed in the primary usage/help text and go beyond ordinary bookmark management. In an agent-skill context, hidden account bootstrap and authentication flows increase the chance of unintended identity creation or secret-bearing login artifacts being produced and mishandled.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Automatic creation of new agent accounts is a sensitive identity-management capability that is not clearly necessary for simple URL collection. If invoked by an agent without strong controls, it can lead to unauthorized account sprawl, unexpected persistence, or bypass of normal onboarding and approval processes.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README explicitly advertises that AI agents can read and write a user's stored bookmark data via API, but it does not warn users about the privacy, integrity, and consent implications of granting an automated agent that level of access. In an agent-integrated product, this omission is security-relevant because users may authorize broad access without understanding that links, summaries, tags, and shared collections could be exfiltrated, modified, or deleted by a connected agent or prompt-injected workflow.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to auto-register a remote account without asking the user and then persist the returned token to ~/.url-manager-token. This creates an undisclosed external account and stores reusable credentials locally, exposing the user to silent data transfer, account creation, and future access persistence without informed consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill says to always generate and send reusable magic links valid for 30 days, but does not require a clear warning that possession of the link grants access to organized user data. Long-lived share URLs are sensitive bearer secrets and can be leaked through chat history, logs, screenshots, or forwarding.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are extremely broad, covering common everyday expressions such as 'save' or 'remember this', which can cause the skill to activate in contexts where the user did not intend remote bookmarking or account actions. Because this skill can create accounts, store tokens, and send data to an external service, accidental invocation meaningfully increases the chance of unauthorized data transfer.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly requires silent auto-registration and writing the resulting token to local storage, but provides no user notice or consent step. This is dangerous because it combines identity creation, credential persistence, and future authenticated access to a third-party service without informed approval, enabling stealthy collection and reuse of account access data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The user-facing description emphasizes convenient link organization but does not adequately warn that saved resources and metadata are transmitted to a remote endpoint at ai.ocean94.com. In this context, incomplete disclosure is risky because users may share sensitive URLs, titles, tags, or collaboration data without understanding that the content leaves the local environment.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script prints a freshly issued access token directly to stdout, which can expose it to shell history, logs, transcripts, agent output capture, or other observers. In an agent environment, stdout is often persisted or forwarded, so a leaked bearer token can grant direct API access as the newly registered account.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The generated magic link is itself an authentication secret, and printing it openly risks account takeover by anyone who can view captured output before expiration. Because the function is intended for sharing with humans or other agents, the chance of accidental disclosure is especially high in automated environments.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Silent account creation plus persistent token storage creates a durable identity and long-term access channel on behalf of the user without disclosure. If the local file is read by another process or user, or if the agent later reuses the token unexpectedly, the user's remote collection and account may be accessed or modified without their knowledge.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: Automatically delivering results through reusable 30-day magic links increases the chance of unintended disclosure of a user's curated resources. Because the link itself is the credential, any leakage of the URL can expose the collection to unintended recipients for an extended period.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Silent registration plus persistent token storage creates a reusable authenticated identity without consent, which can be leveraged for continued access to the user's remote bookmark account. In the context of a skill that is triggered by common conversational phrases, this is especially risky because the authenticated state may be established and reused long after the initial interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

export FOOTPRINTS_TOKEN=$(cat ~/.url-manager-token)
fi

# 2. If no token, auto-register (do NOT ask the user)
if [ -z "$FOOTPRINTS_TOKEN" ]; then
    TOKEN=$(python3 scripts/footprints.py agent_register | grep -o '"token":"[^"]*"' | cut -d'"' -f4)
    export FOOTPRINTS_TOKEN="$TOKEN"

• Confidence: 95% confidence
• Finding: do NOT ask the user

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.