Readeck

Readeck integration for saving and managing articles. Supports adding URLs, listing entries, and managing bookmarks via Readeck's API. Configure custom URL and API key per request or via environment variables READECK_URL and READECK_API_KEY.

Security Scan

The skill's instructions match a Readeck bookmark API (so functionality is coherent) but the package metadata omits declaring the environment credentials the SKILL.md relies on and the source/homepage is missing — exercise caution before providing API keys or a base URL.

Purpose & Capability

The SKILL.md describes Readeck bookmark operations (add/list/get/delete/mark read) and the required HTTP calls are consistent with that purpose. However, the registry metadata does not declare the READECK_URL or READECK_API_KEY as required/primary credentials, which is an omission and reduces transparency.

Instruction Scope

Runtime instructions explicitly instruct the agent to run curl commands that use $READECK_URL and $READECK_API_KEY. The instructions reference environment variables that are not declared in the skill metadata; this mismatch should be clarified because the agent will attempt outbound HTTP requests to whatever URL and key are provided.

Install Mechanism

No install spec or code files are present (instruction-only). This is low risk from installation perspective — nothing is written to disk by the registry/install step.

Credentials

The only sensitive artifacts the skill needs are a Readeck base URL and API key, which are proportionate to the described functionality. That said, those credentials are not listed in the registry's required env fields and no primary credential is declared — and the skill author/source is unknown, so providing a long-lived key without verification is risky.

Persistence & Privilege

The skill is not always-enabled and does not request system-level persistence. Normal autonomous invocation is allowed by platform defaults; there is no evidence it modifies other skills or system config.

What to consider before installing

This instruction-only skill appears to implement legitimate Readeck API calls, but the package metadata omits the READECK_URL/READECK_API_KEY declaration and the skill has no listed source or homepage. Before installing or providing credentials: (1) verify the skill publisher and request source code or a homepage; (2) avoid putting a production API key in a global environment variable—prefer per-request keys or a limited-scope/ephemeral key; (3) ensure READECK_URL points to a trusted Readeck instance (attacker-controlled URLs could receive your API key and saved content); and (4) if you need stronger assurance, ask the publisher to update the registry metadata to declare READECK_URL and READECK_API_KEY as required/primary credentials and provide a link to audited source code. If you cannot verify the author, treat the skill as untrusted and do not supply sensitive credentials.

Readeck Integration

Configuration

Configure Readeck access via:

• Request parameters: url and apiKey
• Environment variables: READECK_URL and READECK_API_KEY

Core Operations

Add Article

Add a URL to Readeck for parsing and saving:

curl -X POST "$READECK_URL/api/bookmarks" \
  -H "Authorization: Bearer $READECK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/article"}'

Response includes id, url, and title.

List Entries

Fetch saved articles:

curl "$READECK_URL/api/bookmarks?limit=20" \
  -H "Authorization: Bearer $READECK_API_KEY"

Query parameters: page, limit, status, search.

Get Single Entry

curl "$READECK_URL/api/bookmarks/$ID" \
  -H "Authorization: Bearer $READECK_API_KEY"

Delete Entry

curl -X DELETE "$READECK_URL/api/bookmarks/$ID" \
  -H "Authorization: Bearer $READECK_API_KEY"

Mark as Read

curl -X PUT "$READECK_URL/api/bookmarks/$ID/status" \
  -H "Authorization: Bearer $READECK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status": "read"}'

Common Patterns

Save with tags:

{"url": "https://example.com", "tags": ["tech", "readlater"]}

Save to specific collection:

{"url": "https://example.com", "collection": "my-collection"}

Filter by status: unread, read, archived

Error Handling

• 401: Invalid API key
• 404: Entry not found
• 422: Invalid URL or request body