Raindrop Sync
v1.0.0Sync and process bookmarks from Raindrop.io. Use when fetching new bookmarks, analyzing saved content, or syncing bookmarks to knowledge base. Triggers on "r...
⭐ 0· 504·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The script fetches bookmarks from api.raindrop.io and the SKILL.md describes fetching, filtering, and storing bookmarks — this aligns with the skill name and description. However, the registry metadata lists no required environment variables or primary credential while the SKILL.md and script both expect RAINDROP_TOKEN; that mismatch is unexpected.
Instruction Scope
SKILL.md instructs sourcing a local secrets file (.secrets/raindrop.env) and mentions reading/writing memory/kb-index.json and memory/knowledge-base.md and calling an external 'web_fetch' step. The included script only performs API fetch and outputs JSON (stdout or file). The extra workflow steps are outside the script but instruct the agent to access local files; this expands the runtime scope beyond a pure fetcher but is coherent with syncing/processing bookmarks.
Install Mechanism
No install spec (instruction-only plus a small included script). Nothing is downloaded or written to system install locations by the skill itself — this is the lowest-risk install pattern.
Credentials
The script and SKILL.md require a Raindrop API token (RAINDROP_TOKEN) but the skill metadata declares no required env vars or primary credential. Omitting a required secret from the manifest can hide the fact that a credential is needed and bypass platform permission prompts. SKILL.md also recommends storing the token in a plaintext file (.secrets/raindrop.env), which has local security implications.
Persistence & Privilege
always is false, the skill does not request persistent/autonomous elevation beyond the platform default, and it does not modify other skills or system-wide configs in its files.
What to consider before installing
This skill appears to do what it claims (fetch Raindrop bookmarks) and the included script is small and readable, but take these precautions before installing: 1) The registry metadata does NOT declare RAINDROP_TOKEN even though the script and SKILL.md require it — ensure you understand where/when you'll supply the token and prefer a platform-managed secret rather than a plaintext file in .secrets/. 2) If you must store the token on disk, keep it out of source control and restrict file permissions. 3) Confirm the only network calls are to api.raindrop.io (the script uses that URL). 4) Be aware the workflow instructs reading/writing memory/kb-index.json and appending to knowledge-base files — verify those paths do not expose sensitive data you don't want the skill to access. 5) If you want the platform to surface a permission prompt, ask the skill author to add RAINDROP_TOKEN to requires.env/primaryEnv in the metadata. If anything about where the token is stored or how the agent will be allowed to run the workflow is unclear, treat this as a potential privacy risk and inspect or run the script locally first.Like a lobster shell, security has layers — review code before you run it.
latestvk970bp86xx0qe6ajwjf02q6n3h816494
License
MIT-0
Free to use, modify, and redistribute. No attribution required.