Readwise & Reader

Access Readwise highlights and Reader saved articles

Security Scan

The skill's code and runtime instructions match its stated purpose (accessing Readwise highlights and Reader documents) and only require your Readwise API token and Node — nothing appears disproportionate or covert.

Purpose & Capability

The scripts call Readwise API endpoints (https://readwise.io/api/v2 and /api/v3) and implement list/get/save/search/export operations described in the skill name/description. The only runtime requirement (READWISE_TOKEN) is appropriate for authenticating to Readwise. One small inconsistency: the registry metadata reported no required env vars or binaries, whereas SKILL.md metadata declares node and READWISE_TOKEN — the behavior in the included scripts matches the SKILL.md (they read READWISE_TOKEN and expect node).

Instruction Scope

SKILL.md instructs the agent/user to set READWISE_TOKEN and run the included node scripts; the scripts only make HTTP requests to readwise.io and output JSON. They do not read other environment variables, local files, or send data to third-party endpoints. Note: SKILL.md suggests storing the token in ~/.clawdbot/clawdbot.json, which is a user action that persists a secret — the skill itself does not auto-write that file.

Install Mechanism

There is no install spec (instruction-only deployment) and the package contains two small JS scripts. Nothing is downloaded from external URLs or installed automatically, so no high-risk install mechanism is present.

Credentials

The only credential used is READWISE_TOKEN, which is proportional and necessary for Readwise API access. The scripts do not request additional unrelated secrets. Again, registry metadata omission of this env var is inconsistent with SKILL.md and included code.

Persistence & Privilege

The skill does not request elevated privileges, does not set always:true, and does not modify other skills or system-wide agent settings. The only persistence vector called out is an instruction to optionally add the token to ~/.clawdbot/clawdbot.json — that is a user step to store a secret and not performed automatically by the skill.

Assessment

This skill appears to do only what it claims: interact with Readwise/Reader using your READWISE_TOKEN and Node. Before installing: (1) confirm you trust the skill source/owner; (2) only provide a Readwise API token (do not reuse more privileged credentials); (3) avoid storing the token in world-readable/shared files — if you put it in ~/.clawdbot/clawdbot.json, ensure correct file permissions; (4) verify you have a Node version with global fetch (Node 18+), or run the scripts in an environment you control; (5) if you want extra assurance, inspect the two included .mjs files locally — they only contact readwise.io and output JSON. If any registry metadata is shown to require no env vars, prefer the SKILL.md and code as the source of truth and proceed accordingly.

Readwise & Reader Skill

Access your Readwise highlights and Reader saved articles.

Setup

Get your API token from: https://readwise.io/access_token

Set the environment variable:

export READWISE_TOKEN="your_token_here"

Or add to ~/.clawdbot/clawdbot.json under "env".

Readwise (Highlights)

List books/sources

node {baseDir}/scripts/readwise.mjs books [--limit 20]

Get highlights from a book

node {baseDir}/scripts/readwise.mjs highlights [--book-id 123] [--limit 20]

Search highlights

node {baseDir}/scripts/readwise.mjs search "query"

Export all highlights (paginated)

node {baseDir}/scripts/readwise.mjs export [--updated-after 2024-01-01]

Reader (Saved Articles)

List documents

node {baseDir}/scripts/reader.mjs list [--location new|later|archive|feed] [--category article|book|podcast|...] [--limit 20]

Get document details

node {baseDir}/scripts/reader.mjs get <document_id>

Save a URL to Reader

node {baseDir}/scripts/reader.mjs save "https://example.com/article" [--location later]

Search Reader

node {baseDir}/scripts/reader.mjs search "query"

Notes

• Rate limits: 20 requests/minute for Readwise, varies for Reader
• All commands output JSON for easy parsing
• Use --help on any command for options