Wallabag

Manage Wallabag bookmarks through the Wallabag Developer API with OAuth2 authentication, including creating, reading, updating, deleting, searching, and tag...

Before installing or enabling this skill: - Be aware the script uses the OAuth password grant: you must supply WALLABAG_USERNAME and WALLABAG_PASSWORD plus a client id/secret. This means you are giving the skill full account credentials; use a dedicated, low-privilege account and client if possible. - The registry metadata omitted required env vars and credentials — treat that as a red flag: confirm the listed required environment variables in SKILL.md are accurate before trusting the skill. - Review scripts/wallabag.sh yourself (it is small and readable). It uses curl and jq, stores tokens only in memory, and removes temporary files; these behaviours are reasonable but verify they meet your policies. - Avoid running auth --show-token in environments where stdout may be logged; it will print the token JSON when requested. - If you prefer not to provide a password to the agent, ask the skill author to implement an authorization-code flow or a token-only flow so long-lived credentials are not supplied. If you cannot verify the code or do not want to expose account credentials, do not install or enable the skill.

Type: OpenClaw Skill Name: wallabag Version: 1.0.1 The skill is designed to manage Wallabag bookmarks via its API. It correctly handles sensitive credentials by requiring them as environment variables and explicitly states that tokens are kept in-process and not persisted to disk. The `scripts/wallabag.sh` uses `curl` for all network interactions and appears to safely construct API requests, mitigating common shell injection risks by passing user inputs as values to `--data-urlencode` or as structured path components. No evidence of data exfiltration to unauthorized endpoints, persistence mechanisms, obfuscation, or prompt injection against the agent was found in any of the files.