Pinboard Manager

Use this skill for ALL Pinboard bookmark management tasks — this is the go-to skill whenever Pinboard (pinboard.in) is involved. Invoke immediately when the...

This skill appears to do what it claims, but consider these practical precautions before installing or running it: - PINBOARD_AUTH_TOKEN grants read/write access to your Pinboard account. Treat it like a password: only provide it to skills you trust, and rotate it if you suspect exposure. - API calls include the token as a URL parameter (Pinboard API design). Avoid pasting the token into shared logs or commands that may be recorded; prefer setting it in a secure shell profile or environment that isn't logged. - The skill caches full bookmark data to /tmp/pinboard_all.json and writes a tag convention file under ~/.config/nini-skill/pinboard-manager/. The cache contains private bookmark notes/metadata unencrypted—remove or secure these files if needed. - Timeliness analysis fetches page content via the third-party Jina Reader (r.jina.ai). URLs and page content for candidate bookmarks will be sent to that external service; do not run that mode if you are uncomfortable exposing bookmark URLs or page contents to a third party. - Because the skill can perform delete/update operations via the API, run it initially in a cautious workflow (review-only / confirm each change) and back up/export your bookmarks before bulk operations. - If you plan to allow autonomous agents to invoke skills, be aware that an agent with access to this skill + token could modify or delete bookmarks; keep token scope limited and monitor activity. If you want more assurance, request an explicit 'dry-run' or review-only mode be added to the skill (no API writes) and/or inspect a sample run output before permitting any confirmed changes.

Type: OpenClaw Skill Name: nini-pinboard-manager Version: 0.3.0 The skill manages Pinboard bookmarks using curl and includes a 'Timeliness Check' that sends bookmark URLs to a third-party service (r.jina.ai). It is classified as suspicious due to the significant risk of shell injection; the instructions (SKILL.md, dead-link.md, and timeliness.md) rely on the AI agent to correctly sanitize and URL-encode user-controlled data—such as bookmark URLs, titles, and tags—before executing them within shell commands. If the agent fails to properly encode these strings, a crafted bookmark could lead to arbitrary command execution on the host system.