Security audit

Bookmark Smart Hub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a bookmark-monitoring assistant, but it asks for sensitive tokens, persistent background execution, external AI and notification integrations, and broad command authority with unclear scoping.

Review this carefully before installing. Only use it with test or least-privilege credentials, avoid browser session tokens where possible, verify the missing npm scripts and package source before running commands, and do not enable daemon mode or notifications until you understand exactly what bookmark content will be stored locally or sent to AI and messaging providers.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims credentials are not uploaded to third parties, yet it explicitly requires external AI and notification services such as OpenAI, Telegram, Slack, and Discord. Even if raw tokens are not forwarded as payload data, the documented architecture necessarily shares user content and uses third-party credentialed integrations, so the privacy statement is misleading and may cause users to underestimate data exposure.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document states that the system does not store personal credentials or sensitive information, but elsewhere instructs users to place multiple secrets in .env and config files. This contradiction is dangerous because it misrepresents secret-handling behavior and can lead operators to apply weaker controls around files that actually contain sensitive tokens.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation text says to use the skill whenever AI model calls, intelligent chat, agent orchestration, or LLM applications are needed, which is extremely broad. In an agent ecosystem, this can cause the skill to activate for generic requests unrelated to bookmark processing, increasing the chance of unnecessary command execution, external API use, and access to sensitive context.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill enables background monitoring, notifications, and external API transmission, but these behaviors are not presented with a prominent upfront consent warning before setup and execution steps. This is risky because users may authorize persistent monitoring or data sharing without understanding that content will be processed continuously and possibly sent to third-party services.

Static analysis

No suspicious patterns detected.