Raindrop.io Bookmarks

• Analyzed: May 12, 2026, 3:04 AM
• Findings: 1
• Version: 1.0.4
• Hash: a2fc67b692c390905b5676dcfaa446897a41c7c53db0e8bd8531753cf561152a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. The `raindrop.sh` script is a CLI wrapper for the Raindrop.io API, performing bookmark management operations as described. It uses standard tools (`bash`, `curl`, `jq`, `bc`) and handles the API token securely by reading it from an environment variable or `~/.config/raindrop.env`. Input validation (`is_int`, `is_uint`) is applied to IDs, and `jq -cn` is used to safely construct JSON payloads, mitigating shell injection risks. All network calls are directed to the legitimate Raindrop.io API. The `SKILL.md` documentation is clear, functional, and contains no prompt injection attempts or instructions for the agent to deviate from its stated purpose or perform malicious actions.