uf2.net URL Shortener

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent uf2.net URL-shortener wrapper; users should mainly notice that it uses an API key and creates public, persistent link metadata.

This skill appears safe for its stated purpose. Before installing, be comfortable giving it a uf2.net API key, avoid shortening sensitive private URLs, and ask the agent to confirm before deleting any existing short links.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

An agent or user session with this key can manage links in the uf2.net account.

Why it was flagged

Authenticated account operations require a uf2.net API key. This is expected for the service, but it grants account-level authority to create, list, inspect, and delete links.

Skill content

credentials:
  - name: UF2_API_KEY
    description: API key from uf2.net account registration
    required: true

Recommendation

Use a dedicated API key or account where possible, store the key securely, and require explicit approval for destructive account actions.

Note

ASI02: Tool Misuse and Exploitation

What this means

If invoked incorrectly, a link could be deleted and shared short URLs could stop working.

Why it was flagged

The wrapper exposes a destructive delete operation against the external service. This is purpose-aligned for link management, but the script itself does not add an extra confirmation step.

Skill content

delete)  cmd_delete "${@:2}" ;; ... curl -s -X DELETE "$API_BASE/links/$code" \

Recommendation

Have the agent confirm the exact short-code before deletion, especially for links that may already be shared publicly.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Shortening a private or sensitive URL may expose the original target URL and leave it available until manually deleted.

Why it was flagged

The skill clearly discloses that original URLs and click metadata are stored by the provider and publicly readable, with no automatic expiration.

Skill content

Metadata visibility: Link metadata (click counts, original URL) is publicly readable
- No link expiration: Links persist indefinitely unless manually deleted

Recommendation

Only shorten URLs whose target and metadata are acceptable to share publicly, and delete links when they should no longer be available.