Karakeep Save

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it saves user-provided bookmarks to a configured Karakeep server, with a transport-security caveat users should check.

Install only if you intend to let the skill send saved URLs and optional notes to your Karakeep server using your API key. Configure KARAKEEP_URL with https://, avoid plain HTTP except possibly tightly controlled local testing, and rotate the API key if it may have been used over an untrusted HTTP connection.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/save.sh:38

Finding

Bearer API Token May Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/save.sh, lines 38–41
Vulnerability Type: Missing transport security enforcement
Risk Level: High

bash

RESPONSE=$(curl -s -X POST "${KARAKEEP_URL}/api/v1/bookmarks" \
  -H "Authorization: Bearer ${KARAKEEP_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$BODY")

Technical Analysis

The script constructs the API endpoint directly from the user-configurable KARAKEEP_URL environment variable without validating its URL scheme. Although the documentation shows an HTTPS example, the implementation accepts an http:// endpoint.

If HTTP is configured, curl transmits the bearer API key in the Authorization header without transport encryption. The bookmark URL and optional note are also exposed in plaintext. The use of shell quoting prevents this value from becoming direct shell command injection, but it does not provide transport confidentiality or server authentication.

Attack Path

1. The user or deployment configuration sets KARAKEEP_URL to an endpoint beginning with http://.
2. The user invokes scripts/save.sh with a bookmark URL and, optionally, a note.
3. The script places KARAKEEP_API_KEY in the HTTP Authorization: Bearer header.
4. curl sends the request over an unencrypted network connection.
5. An attacker with a network position—such as one controlling a shared network, gateway, or compromised routing infrastructure—captures the API token and bookmark data.
6. The attacker reuses the captured token against the Karakeep API within the token's assigned permissions.

Impact Assessment

A successful attack exposes the Karakeep API key, submitted bookmark URLs, and associated notes. The attacker can impersonate the token holder and perform any API operation authorized for that token. The exact privilege and data scope depend on the server-side permissions assigned to the compromised key; this script does not itsel ...[truncated 38 chars]

Remediation

View remediation

Remediation Suggestions

• Parse and validate KARAKEEP_URL before issuing the request, rejecting every scheme except https://.
• If plaintext HTTP is necessary for local development, require an explicit opt-in setting and restrict it to loopback addresses such as 127.0.0.1 or localhost.
• Normalize the configured base URL and validate its hostname to reduce configuration errors.
• Add appropriate curl protections, including --fail-with-body, --proto '=https', connection and total-operation timeouts, and a redirect policy that prevents credentials from being forwarded to an unintended host.
• Do not disable TLS certificate verification. Use a correctly configured trusted CA bundle for private deployments.
• Rotate the API key immediately if it may previously have been transmitted over HTTP.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a shell script and requires networked API access, but it does not declare any explicit tool scope or permissions. This weakens sandboxing and review because the agent may execute shell capabilities without a clearly documented least-privilege boundary, increasing the chance of unintended command execution or misuse in environments that rely on manifest-declared restrictions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/save.sh (reported line 39)May include surrounding context.

sh

fi

# Make API request
RESPONSE=$(curl -s -X POST "${KARAKEEP_URL}/api/v1/bookmarks" \
  -H "Authorization: Bearer ${KARAKEEP_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$BODY")

Static analysis

No suspicious patterns detected.