ClawHub
Back to skill

Security audit

Bookmark Smart Hub Free

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent bookmark-organizing purpose, but it asks for sensitive social-platform session tokens while under-disclosing how those tokens are used with external services and tools.

Review this carefully before installing. Only use it if you understand that auth_token and ct0 are effectively account session credentials, that they will be used in outbound requests to the social platform or CLI tooling, and that bookmarked third-party links may be fetched and saved locally. Prefer a dry run first, keep the .env file private, and verify the actual npm package and bird CLI before providing credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The documentation states that credentials never leave the local machine, yet the workflow explicitly requires using those credentials to authenticate to external services and CLI tools. This is dangerous because it can mislead users about trust boundaries, causing them to provide sensitive session tokens under a false assumption that no external transmission occurs.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger scope is excessively broad, listing many generic keywords and operations unrelated to a narrowly bounded bookmark-processing workflow. In an agent environment, this can cause accidental invocation in unrelated contexts, leading the skill to access external links, process data, or write files when the user did not intend to run it.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill description does not clearly warn, at the outset, that execution will visit third-party URLs and save extracted content to local storage. This is risky because users may trigger the skill without understanding that it performs network access and persistent writes, which affects privacy, safety, and system state.

Static analysis

No suspicious patterns detected.