Karakeep

Manage bookmarks and links in a Karakeep instance. Use when the user wants to save links, list recent bookmarks, or search their collection. Triggers on phrases like "hoard this link", "save to karakeep", or "search my bookmarks".

Security Scan

The skill appears to implement a bookmark CLI consistent with its description, but it omits declaring the API key/URL it needs, reads/writes config in the user's home, and defaults to an unexpected host — these mismatches warrant caution.

Purpose & Capability

The name/description and included CLI script align with a bookmark manager. However, the skill metadata declares no required environment variables or primary credential even though the CLI requires an API key (KARAKEEP_API_KEY or HOARDER_API_KEY) and may use a service URL. That missing declaration is disproportionate to the stated purpose and reduces transparency.

Instruction Scope

SKILL.md instructs the agent to run the bundled script via 'uv' to login, add, list, and search bookmarks — this stays within the bookmark-management scope. It also instructs setting env vars or running 'login' and references ~/.config/karakeep/config.json; the runtime will read an older config at ~/.config/hoarder/config.json and will write to ~/.config/karakeep/config.json, which is expected behavior but should be explicit in requirements.

Install Mechanism

There is no install spec and no external downloads; the skill is instruction-only with an included Python script that expects the 'uv' runner and the requests library. This is low-risk from an install perspective.

Credentials

The code reads KARAKEEP_URL / HOARDER_URL (defaulting to https://hoard.phen.boo), and KARAKEEP_API_KEY / HOARDER_API_KEY, but the registry metadata declares no required env/primary credential. Requiring an API key is reasonable for this functionality, but the omission is a transparency issue. Also, the default host (hoard.phen.boo) is unexpected and should be documented/verified before use.

Persistence & Privilege

The skill writes only its own config at ~/.config/karakeep/config.json and may read an old ~/.config/hoarder/config.json for migration. always is false and it does not modify other skills or system-wide settings — persistence is limited and proportional.

What to consider before installing

This package implements a bookmark CLI and is mostly coherent, but it needs an API key and may default to a non-obvious host. Before installing or running: (1) verify the Karakeep instance URL you want to use (do not rely on the default hoard.phen.boo unless you trust that host), (2) provide the API key via KARAKEEP_API_KEY or run the included login command so credentials are stored only in ~/.config/karakeep/config.json, and (3) be aware the tool will read an old hoarder config (~/.config/hoarder/config.json) if present. The missing declaration of required environment variables in the skill metadata is a transparency issue — treat this as a legitimate but imperfect implementation rather than confirmed malicious code.

Karakeep Skill

Save and search bookmarks in a Karakeep instance.

Setup

First, configure your instance URL and API key:

uv run --with requests skills/karakeep/scripts/karakeep-cli.py login --url <instance_url> <api_key>

Commands

Save a Link

Add a URL to your collection:

uv run --with requests skills/karakeep/scripts/karakeep-cli.py add <url>

List Bookmarks

Show the most recent bookmarks:

uv run --with requests skills/karakeep/scripts/karakeep-cli.py list --limit 10

Search Bookmarks

Find bookmarks matching a query. Supports complex syntax like is:fav, title:word, #tag, after:YYYY-MM-DD, etc.:

uv run --with requests skills/karakeep/scripts/karakeep-cli.py list --search "title:react is:fav"

Troubleshooting

• Ensure KARAKEEP_API_KEY (or HOARDER_API_KEY) is set or run login.
• Verify the instance URL is correct in the script or config (~/.config/karakeep/config.json).