← 返回 Skills 市场

karakeep-sh

Name: karakeep-sh
Author: vandeefeng

作者 Vandee · GitHub ↗ · v1.0.3 · MIT-0

cross-platform ⚠ suspicious

785

总下载

当前安装

版本数

在 OpenClaw 中安装

/install karakeep-sh

功能描述

Karakeep bookmark manager with full native RESTful API support including notes, updates, and deletion.

使用说明 (SKILL.md)

Karakeep Skill

Advanced Karakeep bookmark management with full REST API support.

Add KARAKEEP_SERVER_URL and KARAKEEP_API_KEY to environment variables and jq for pretty-printing JSON responses.

If they are missing, provied a clear guide to the user.

IMPORTANT:always ask user to confirm beefore you delete a bookmark,

Complete Function Reference

Use this script karakeep-script.sh

We have the functions below:

Function	Description
`kb-create`	Create bookmark (supports note)
`kb-update-note`	Update bookmark note
`kb-delete`	Delete bookmark
`kb-get`	Get bookmark details
`kb-list`	List all bookmarks (with limit)
`kb-content`	Get markdown content
`kb-search`	Search with qualifiers
`kb-lists`	List all lists
`kb-create-list`	Create new list
`kb-add-to-list`	Add to list
`kb-remove-from-list`	Remove from list
`kb-attach-tags`	Attach tags
`kb-detach-tags`	Detach tags

Available Operations

Create Bookmark with Note

# Link bookmark with note
kb-create link "https://example.com" "Example Site" "My analysis and notes here..."

# Text bookmark with note
kb-create text "Text content here" "My Note" "Additional notes..."

Update Bookmark Note

kb-update-note "bookmark_id" "Updated note content..."

Delete Bookmark

kb-delete "bookmark_id"

Get Bookmark

kb-get "bookmark_id"

Search Operations

# Search with qualifiers (uses MeiliSearch backend)
kb-search "is:fav after:2023-01-01 #important"
kb-search "machine learning is:tagged"
kb-search "list:reading #work"

# Search with custom limit and sort order
kb-search "python" 50 "desc"  # 50 results, descending order

# Available qualifiers:
# - is:fav, is:archived, is:tagged, is:inlist
# - is:link, is:text, is:media
# - url:\x3Cvalue>, #\x3Ctag>, list:\x3Cname>
# - after:\x3CYYYY-MM-DD>, before:\x3CYYYY-MM-DD>

# Sort options: relevance (default), asc, desc

API Parameters:

q (required): Search query string with qualifiers
limit (optional): Results per page (default: server-controlled)
sortOrder (optional): asc | desc | relevance (default)
cursor (optional): Pagination cursor
includeContent (optional): Include full content (default: true)

List Management

# List all lists
kb-lists

# Create new list
kb-create-list "Reading List" "📚"

# Add bookmark to list
kb-add-to-list "bookmark_id" "list_id"

# Remove bookmark from list
kb-remove-from-list "bookmark_id" "list_id"

Tag Management

# Attach tags
kb-attach-tags "bookmark_id" "important" "todo" "work"

# Detach tags
kb-detach-tags "bookmark_id" "oldtag" "anotherold"

Notes

All responses are in JSON format
Bookmark IDs are returned in creation responses
Use jq for pretty-printing JSON responses
API rate limits may apply

安全使用建议

This skill's code is a straightforward shell client that requires two environment variables (KARAKEEP_SERVER_URL and KARAKEEP_API_KEY) and the jq utility, but the registry metadata does not declare them — that mismatch is the main concern. Before installing: (1) confirm you trust the skill owner (source unknown); (2) do not export your API key globally if you don't trust the skill — consider using a throwaway account or scoped key; (3) inspect the script (it is included) and prefer sourcing it in a constrained shell or running it from an isolated environment; (4) note that SKILL.md asks the agent to confirm before deletes but the kb-delete function issues DELETE immediately — instruct the agent to always prompt the user before running kb-delete; and (5) ask the publisher to update registry metadata to declare required env vars and binaries. If you need stronger assurance, request a signed/source-linked release or run the script in a sandbox first.

功能分析

Type: OpenClaw Skill Name: karakeep-sh Version: 1.0.3 The skill bundle provides a functional interface for the Karakeep bookmark manager, but it contains a command injection vulnerability in the `kb-create-list` function within `scripts/karakeep-script.sh`. This function directly interpolates shell variables (`$name` and `$icon`) into a double-quoted string passed to `curl`, which allows for arbitrary command execution if the input contains shell metacharacters (e.g., `$(command)`). While most other functions correctly use `jq` for parameter handling, this specific flaw represents a significant security risk, although there is no clear evidence of intentional malice.

能力评估

⚠ Purpose & Capability

The skill's purpose (Karakeep REST bookmark manager) matches what the script does (calls a user-provided Karakeep API), but the registry metadata declares no required environment variables or primary credential while the script clearly requires KARAKEEP_SERVER_URL and KARAKEEP_API_KEY. That omission is incoherent with the stated purpose.

ℹ Instruction Scope

SKILL.md instructs the agent to require KARAKEEP_SERVER_URL and KARAKEEP_API_KEY and to always ask the user for confirmation before deletes; the script does check the env vars, but the kb-delete function performs the DELETE immediately (no interactive confirmation). Otherwise the SKILL.md operations map closely to script functions and are within the scope of a bookmark client.

✓ Install Mechanism

This is an instruction-only skill with a single shell script and no install spec, so nothing is downloaded or installed automatically. That minimizes install risk.

⚠ Credentials

The skill requires a service URL and an API key (sensitive credential) to operate, but the registry metadata lists no required env vars and no primary credential. Additionally, the script assumes availability of jq and curl but the metadata lists no required binaries. Requiring an API key is proportional to the purpose, but failing to declare it in metadata is a red flag.

✓ Persistence & Privilege

The skill does not request persistent/always-on privileges, does not modify other skills, and runs only when invoked. It executes network calls to the user-provided API endpoint only, which matches its purpose.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install karakeep-sh
安装完成后，直接呼叫该 Skill 的名称或使用 /karakeep-sh 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.3

karakeep-sh v1.0.3 - Updated description to clarify full native RESTful API support. - Added setup instructions: users must add KARAKEEP_SERVER_URL and KARAKEEP_API_KEY to environment variables and use `jq` for JSON pretty-printing. - Stated that if these environment variables are missing, users should be shown a clear guide. - Emphasized that users should always be asked for confirmation before deleting a bookmark.

v1.0.2

- Solve some endpoint issues

v1.0.1

karakeep-sh 1.0.1 - fix some jq command issue.

v1.0.0

- Initial release of karakeep skill for advanced bookmark management. - Full REST API support: create, update, delete, and retrieve bookmarks. - List and tag management: create lists, add/remove bookmarks, attach/detach tags. - Powerful search with qualifiers and custom sorting. - Requires KARAKEEP_SERVER_URL and KARAKEEP_API_KEY environment variables.

元数据

Slug karakeep-sh

版本 1.0.3

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 4

常见问题

karakeep-sh 是什么？

Karakeep bookmark manager with full native RESTful API support including notes, updates, and deletion. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 785 次。

如何安装 karakeep-sh？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install karakeep-sh」即可一键安装，无需额外配置。

karakeep-sh 是免费的吗？

是的，karakeep-sh 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

karakeep-sh 支持哪些平台？

karakeep-sh 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 karakeep-sh？

由 Vandee（@vandeefeng）开发并维护，当前版本 v1.0.3。