ClawHub
Back to skill

Security audit

Bookmarks

Security checks across malware telemetry and agentic risk

Overview

The bookmark skill is mostly purpose-aligned, but it should go to Review because it can fetch full assistant messages from session history and persist them through a missing external bookmark script.

Review before installing. Use this only if you are comfortable with `/save` potentially storing complete assistant replies from session history on disk, and verify the missing `bookmark.py` implementation and storage location before relying on it for sensitive conversations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation describes executing local scripts via shell-like command mappings (`handler.py`, `bookmark.py`) but declares no permissions, creating a capability/permission mismatch. This is dangerous because users and policy layers are not informed that the skill can invoke executable code, reducing transparency and weakening review and containment controls.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill retrieves full assistant messages from session history when a user replies with `/save`, but it does not clearly warn the user that the operation expands access beyond the visible truncated message. This can cause unintended collection and persistence of more conversation content than the user reasonably expects, including sensitive data present in the full historical response.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill persists bookmarked content to `memory/bookmarks.md` as an append-only local log without an explicit warning to the user that saved text will be retained on disk. This is risky because users may save sensitive conversation content assuming ephemeral handling, while the append-only design increases retention and makes accidental long-term storage more likely.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.