ClawHub
Back to skill

Security audit

Raindrop Sync

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Raindrop.io bookmark sync helper, but it asks agents to persist bookmark-derived web content into local memory and suggests automatic cron-style syncing without enough user control or containment.

Review before installing. Use a read-only Raindrop token, run fetches manually at first, and only allow writes to knowledge-base files after confirming the destination and content handling. Avoid enabling the cron or heartbeat example unless you specifically want automatic persistent updates from saved web pages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The code accurately covers the 'fetching new bookmarks' portion of the description, but it does not implement analysis of saved content or syncing bookmarks to a knowledge base. Its actual behavior is limited to retrieving bookmark metadata from Raindrop.io and serializing it as JSON. Because the declared description presents a broader set of core capabilities than the code provides, the description does not accurately represent the full behavior of this code chunk.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs use of environment secrets, network access to the Raindrop API, and local file modification, but it does not declare any explicit tool scope or permissions. That makes the skill's effective capabilities less transparent and weakens review and runtime containment, increasing the chance of unintended secret use, external data transfer, or file changes.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger phrases include broad terms like 'raindrop', 'bookmarks', and 'new saves', which may match ordinary conversation and cause the skill to activate unexpectedly. In this skill's context, accidental activation could lead to network calls, token use, or file writes without the user clearly intending to run a bookmark sync workflow.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The workflow explicitly instructs appending content to `memory/knowledge-base.md` and updating `memory/kb-index.json` without warning the user that local persistent data will be modified. Silent or implicit writes are risky because they can corrupt knowledge stores, introduce untrusted web content into local memory, or overwrite user-maintained state.

External Transmission

Medium
Category
Data Exfiltration
Content
from urllib.request import Request, urlopen
from urllib.error import HTTPError

API_BASE = "https://api.raindrop.io/rest/v1"

def parse_duration(s: str) -> timedelta:
    """Parse duration string like '24h', '7d', '1w'."""
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
from urllib.request import Request, urlopen
from urllib.error import HTTPError

API_BASE = "https://api.raindrop.io/rest/v1"

def parse_duration(s: str) -> timedelta:
    """Parse duration string like '24h', '7d', '1w'."""
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
98% confidence
Finding
The cron integration example is written in Chinese ("每天检查一次 Raindrop 新书签，处理后存入知识库") while the rest of the skill is in English, and there is no opt-in or explanation for the language switch. This creates a language-policy issue because the skill imposes a locale-specific instruction without user choice or justification.

Static analysis

No suspicious patterns detected.