Manage bookmarks with Linkding. Use when the user asks to "save a bookmark", "add link", "search bookmarks", "list my bookmarks", "find saved links", "tag a bookmark", "archive bookmark", "check if URL is saved", "list tags", "create bundle", or mentions Linkding bookmark management.
Security Analysis
medium confidenceThe skill appears to implement a legitimate Linkding bookmark client, but the package metadata omits important runtime requirements (credentials, config path, and required binaries), which is an inconsistency you should understand before installing.
The name/description (Linkding bookmark management) matches the included files: SKILL.md, README, and a shell API helper that implements listing, creating, updating, tagging, bundles, etc. The functionality described is coherent with a Linkding REST client.
SKILL.md directs the agent to use the provided scripts/linkding-api.sh and to store a Linkding URL/API token in ~/.clawdbot/credentials/linkding/config.json (or provide env vars). The instructions do not request unrelated files, system-wide secrets, or external endpoints beyond the Linkding server URL the user supplies.
There is no install spec (instruction-only), which is low risk. However, the shipped script requires runtime tools (curl and jq) but the skill metadata declares no required binaries. That mismatch could cause runtime failures or surprise dependency assumptions.
Registry metadata lists no required environment variables or config paths, but the script expects LINKDING_URL and LINKDING_API_KEY (or a config file at ~/.clawdbot/credentials/linkding/config.json) and optionally LINKDING_CONFIG. These are appropriate for the skill's purpose, but the metadata omission is a notable inconsistency: the skill will need an API token (sensitive secret) and a server URL which the registry did not declare.
The skill does not request always: true and does not modify other skills or system-wide settings. It reads a user-provided config file in the user's home directory and does not appear to persist additional credentials or perform privileged system changes.
Guidance
This skill appears to be a straightforward Linkding REST client, but pay attention to these points before installing: (1) The metadata omitted required runtime items — you must provide an API token and Linkding URL (either in ~/.clawdbot/credentials/linkding/config.json or via LINKDING_URL/LINKDING_API_KEY env vars). (2) The included script depends on curl and jq; install those or the script will fail. (3) Verify the LINKDING_URL you configure is the intended server (don't point it at an unknown third-party), since the script will send your API token to that URL. (4) Inspect scripts/linkding-api.sh yourself (it is plain shell) to confirm you are comfortable with its behavior. If you want to proceed, create the config file manually and only grant the API token minimal permissions; if the metadata or registry page cannot explain why credentials/config requirements were omitted, consider contacting the skill author or using an alternative with correct metadata.
Latest Release
v1.0.1
- Added README.md file. - Added explicit version field (1.0.1) to SKILL.md.
More by @jmagar
Published by @jmagar on ClawHub
