Security audit

Karakeep

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Karakeep CLI guide that uses expected credentials and bookmark-management commands, with some install and secret-handling cautions.

Before installing, verify that @karakeep/cli and the Docker image come from the intended Karakeep project, prefer pinned or reviewed versions if your environment requires stronger supply-chain controls, use environment variables or a protected secret store instead of putting API keys on the command line, and confirm bookmark or list IDs before running delete commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Unpinned Executable Dependencies Permit Mutable Supply-Chain Code
Content: View full analysis
Remediation: View remediation
``` 2. Pin the container image to an immutable digest: ```bash docker run --rm ghcr.io/karakeep-app/karakeep-cli@sha256: --help ``` 3. Document how users can verify package provenance, checksums, signatures, and the expected publisher. 4. Review npm lifecycle scripts before installation and use installation controls appropriate to the verified package. 5. Prefer a project-local or isolated installation over a global installation when practical. 6. Advise users not to install with administrative privileges unless strictly necessary. 7. Establish a controlled update process in which new package versions and image digests are reviewed before the Skill documentation is updated. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:154
Finding: API Key Can Be Exposed Through Command-Line Arguments
Content: View full analysis
--server-addr ``` ``` ### Technical Analysis The documented alternative places the Karakeep API key directly in the command-line argument vector. Depending on the operating system, shell, and execution environment, command arguments may be exposed through: - Process-inspection utilities or process metadata. - Shell history files. - Terminal session recording. - CI/CD and automation logs. - Diagnostic or monitoring agents. - Error reports that capture invoked commands. Although the Skill recommends environment variables as its primary authentication method, retaining the command-line alternative encourages a weaker secret-handling pattern. Environment variables are not universally secret either, but they avoid routine shell-history and argument-list exposure when handled correctly. The API key is necessary for authenticated Karakeep operations, and transmitting it to the user-configured Karakeep server is consistent with the Skill's declared functionality. The vulnerability is the local handling and disclosure risk created by putting the key in command arguments, not the authenticated network request itself. ### Attack Path 1. A user follows the documented command and substitutes a real Karakeep API key for ``. 2. The command is saved in shell history, captured by automation logs, or temporarily exposed through process inspection. 3. Another local user, administrator, monitoring system operator, or party with access to retained logs retrieves the API key. 4. The party submits authenticated requests to the configured Karakeep server using the stolen key. 5. The party accesses or modifies resources allowed by the API key until the credential is revoked or expires. ...[truncated 707 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents destructive commands such as karakeep lists delete <list-id> and karakeep bookmarks delete <bookmark-id> without any warning, confirmation guidance, or advice to verify identifiers first. In an agent-assisted context, that increases the chance of accidental data loss because an automated system may translate user intent into irreversible actions too eagerly.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

Low

Category: Tool Misuse
Confidence: 15% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
Or via Docker:

bash
docker run --rm ghcr.io/karakeep-app/karakeep-cli:release --help

Authentication

Static analysis

No suspicious patterns detected.