fieldtheory-cli-bookmarks
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the global installation of an external CLI tool named
fieldtheoryvia npm from a repository not associated with the primary vendor. - [DATA_EXFILTRATION]: To sync bookmarks without an official API, the tool reads sensitive session data and authentication state from the Google Chrome application folder on the local filesystem. It also stores OAuth tokens in a local file (
~/.ft-bookmarks/oauth-token.json). - [COMMAND_EXECUTION]: The provided Node.js code examples for agent integration use
child_process.execSyncwith unsanitized string interpolation of variables (e.g.,ft search "${query}"). If an agent uses these examples without proper escaping, it would be vulnerable to command injection from untrusted user input. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated content from X/Twitter (bookmarks) which is then indexed, searched, and summarized by the agent. This ingestion point provides a surface for malicious instructions embedded in bookmarks to influence the agent's behavior.
- [PERSISTENCE]: The documentation encourages establishing automated bookmark synchronization through
crontab, which configures a persistent recurring execution of the CLI tool on the user's system.
Audit Metadata