Karakeep Save

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone using the configured key through this skill can create bookmarks in the associated Karakeep instance.

Why it was flagged

The skill needs a Karakeep bearer API key to authenticate to the user's bookmark service. This is expected for the integration, but it is still delegated account access.

Skill content

export KARAKEEP_URL="https://your-karakeep-instance.com"
export KARAKEEP_API_KEY="your-api-key"
...
- **Auth:** Bearer token

Recommendation

Use a Karakeep API key you can revoke, scope it narrowly if Karakeep supports scoped keys, and store it only in the intended Clawdbot or shell environment.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

When invoked, the skill will send the provided URL and optional note to the configured Karakeep server and create or detect a bookmark there.

Why it was flagged

The script performs an authenticated POST that mutates the user's Karakeep data by adding a bookmark. This is the advertised function and is scoped to one API endpoint.

Skill content

RESPONSE=$(curl -s -X POST "${KARAKEEP_URL}/api/v1/bookmarks" \
  -H "Authorization: Bearer ${KARAKEEP_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$BODY")

Recommendation

Invoke it only for URLs you intend to save, and verify KARAKEEP_URL points to your trusted Karakeep instance.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users may not notice from the registry metadata alone that the skill needs a Karakeep API key and local curl/jq tools.

Why it was flagged

The registry metadata does not advertise the credential, environment variables, or local command dependencies that the SKILL.md and script require. This is a declaration/provenance gap rather than hidden behavior.

Skill content

Source: unknown
Homepage: none
Required binaries (all must exist): none
Required env vars: none
Primary credential: none

Recommendation

Review the included script before use, ensure curl and jq are installed, and prefer skills with complete metadata and a known source when handling credentials.