Raindrop Sync
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using the token through this skill may be able to read bookmark data from the linked Raindrop account.
The skill uses a Raindrop.io account token to authenticate API requests. This is expected for the stated integration, but the token should be scoped carefully.
Save to `.secrets/raindrop.env`: RAINDROP_TOKEN=your_token_here
Use a read-only Raindrop token if available, keep it in a private secrets file, and rotate it if exposed.
Saved bookmarks and fetched page summaries may remain available to future agent tasks through the knowledge base.
The workflow persists bookmark-derived content and URLs into memory files for later reuse. This is aligned with the knowledge-base purpose, but it may retain private browsing or research interests.
Store — Append to `memory/knowledge-base.md` Update index — Add URL to `memory/kb-index.json`
Review what bookmark content is written to memory, exclude private collections if needed, and define retention or deletion practices.
If scheduled, new bookmarks may be fetched and stored automatically on an ongoing basis.
The skill documents optional recurring execution. This is disclosed and user-directed, but it can cause the agent or environment to keep syncing bookmarks without a fresh manual request each time.
Add to heartbeat or cron for automatic sync
Only add scheduled sync if you want recurring processing, and make sure the schedule, output files, and knowledge-base updates are easy to disable.