Buku

Manage bookmarks using buku CLI. Use when: adding/saving URLs, searching bookmarks, listing/browsing saved links, tagging bookmarks, importing/exporting book...

Security Scan

The SKILL.md clearly documents use of the buku CLI and local DB access, but the registry metadata does not declare the required binary or provide an install step — this mismatch and the presence of destructive CLI flags (e.g., --tacit, --replace) warrant caution.

Purpose & Capability

The skill's name, description, and SKILL.md all describe using the buku CLI and operating on a local SQLite DB (~/.local/share/buku/bookmarks.db). However, registry metadata lists no required binaries and no install spec. That is internally inconsistent: a buku CLI is clearly required at runtime but not declared. The DB path is also explicitly referenced, which implies the skill will read/write that local file.

Instruction Scope

Instructions are narrowly focused on invoking buku CLI commands (add, search, list, import/export, update, delete). This stays within the stated purpose. However, the doc repeatedly instructs use of --nostdin and --tacit (skip confirmations) and shows destructive operations (deletes, tag-replace) — if an agent follows these instructions without additional user confirmation it can delete or overwrite bookmarks silently. The skill also documents auto-fetching metadata from the web (unless --offline is used), so runtime network requests are possible.

Install Mechanism

There is no install specification and no declared required binary, yet the skill assumes the buku CLI is available. That mismatch is problematic: either the registry should declare buku as a required binary or provide an install step, or the SKILL.md should explicitly state the prerequisite. The absence increases the chance of runtime failures or unexpected behavior if a different buku version/implementation is present.

Credentials

The skill requests no environment variables or credentials, which is proportionate. Two caveats: (1) it operates on a local DB path (~/.local/share/buku/bookmarks.db) so it requires filesystem access to that file; (2) some operations auto-fetch from the web when adding/updating bookmarks, which implies outbound network access (and potential transmission of bookmark URLs to remote hosts). Both behaviors are consistent with a bookmark CLI but are worth noting from a privacy/security perspective.

Persistence & Privilege

The skill does not request always:true and does not claim persistent or system-wide privileges. It's instruction-only and relies on invoking the buku binary at runtime; it does not modify other skills' configurations or request special platform privileges.

What to consider before installing

This skill is largely coherent (it documents how to run the buku CLI), but it has a notable omission: the registry metadata does not declare that the buku binary is required or provide an install step. Before installing or enabling the skill: - Confirm you have the buku CLI installed and which version will be invoked (buku must be on PATH). The registry should declare this requirement — ask the publisher to add it. - Back up ~/.local/share/buku/bookmarks.db before letting the agent run commands (delete/replace operations can be performed with --tacit and will skip confirmation). - Require explicit user confirmation before any destructive command (delete, replace, import with overwrite). If you are installing into an autonomous agent, ensure it will prompt you first. - Be aware that add/update operations may auto-fetch page metadata (network requests). If you want to avoid outbound requests, use --offline as described. - If you want safer deployment, ask the publisher to include a declared required-binaries entry and/or an install spec so the agent can verify the binary and version before executing. If you cannot verify these points or you do not want the agent to have filesystem/network access to your bookmarks DB, do not enable this skill.

buku — Bookmark Manager

CLI bookmark manager with SQLite backend. Always use --nostdin and --np flags to prevent interactive prompts.

Common Operations

Add bookmark

buku --nostdin -a "URL" --tag tag1,tag2 --title "Title" -c "Description"

Omit --title to auto-fetch from web. Use --offline to skip fetching.

Search

# Any keyword
buku --nostdin --np -s keyword1 keyword2

# All keywords
buku --nostdin --np -S keyword1 keyword2

# By tag (ANY match with comma, ALL match with +)
buku --nostdin --np -t tag1,tag2
buku --nostdin --np -t tag1+tag2

# Regex
buku --nostdin --np -r "pattern"

# Deep search (substring matching)
buku --nostdin --np -s keyword --deep

List/Print

# Last N bookmarks
buku --nostdin --np -p -5

# All bookmarks
buku --nostdin --np -p

# Specific index
buku --nostdin --np -p 42

# JSON output (preferred for parsing)
buku --nostdin --np -p -j

# Limit fields: 1=URL, 2=URL+tag, 3=title, 4=URL+title+tag, 5=title+tag
buku --nostdin --np -p -f 4

List all tags

buku --nostdin --np -t

Update bookmark

# Update fields at index
buku --nostdin -u INDEX --url "NEW_URL" --title "New Title" --tag tag1,tag2

# Append tags
buku --nostdin -u INDEX --tag + newtag1,newtag2

# Remove tags
buku --nostdin -u INDEX --tag - oldtag

# Refresh title/description from web
buku --nostdin -u INDEX

Delete

# By index (use --tacit to skip confirmation)
buku --nostdin --tacit -d INDEX

# Range
buku --nostdin --tacit -d 10-20

Import/Export

# Import from browser
buku --nostdin --ai

# Import from file (.html, .md, .json, .org, .db)
buku --nostdin -i bookmarks.html

# Export to markdown
buku --nostdin -e bookmarks.md

# Export search results
buku --nostdin -s keyword -e results.md

Tag management

# Replace tag everywhere
buku --nostdin --replace oldtag newtag

# Delete tag everywhere
buku --nostdin --replace oldtag

Important Notes

• Always use --nostdin as first arg to prevent waiting for input
• Always use --np for search/print to skip interactive prompt
• Use --tacit for delete operations to skip confirmation
• Use -j for JSON output when parsing results programmatically
• DB location: ~/.local/share/buku/bookmarks.db