The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the git command-line tool via node:child_process and docker compose to manage repository snapshots and service lifecycle. These operations are restricted to specific, configured project and configuration directories.- [DYNAMIC_EXECUTION]: The skill utilizes os.execve in mcp_launcher.py for process replacement to launch the official Karakeep MCP server. It also uses subprocess.Popen in runtime.py to isolate HTTP requests within a separate worker process to enforce strict timeouts and prevent network-based attacks.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external web content that may contain malicious instructions. \n- Ingestion points: Content is ingested via the Karakeep.content method in scripts/knowledge/karakeep.mjs which fetches Markdown data from the local Karakeep API.\n- Boundary markers: The instructions in SKILL.md and references/use.md explicitly state that saved pages are untrusted and their embedded instructions must not be followed or used to authorize tool calls.\n- Capability inventory: The skill possesses the ability to read and write files within a designated stateRoot, execute git locally, and communicate with local services via HTTP.\n- Sanitization: All network requests are strictly validated to ensure they only target loopback addresses (127.0.0.1, localhost, ::1) in both the Node.js and Python helper scripts, preventing data exfiltration to external domains.

karakeep-knowledge