karakeep is an AI agent skill, created by jayphen and published at openclaw/skills. ClawSecure audited karakeep across 3 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 40/100 (Warning). The 7 findings concentrate in Data Exfiltration, Policy Violation and Unauthorized Tool Use, including Script accesses environment variables and makes network calls in... and Environment variable access with network calls in.... 2 were rated high or critical severity.
Is karakeep safe?
ClawSecure audited karakeep and assigned a security score of 40/100 (Warning), identifying 7 findings across Data Exfiltration and Policy Violation. Review the findings below before installing.
What did ClawSecure find in karakeep?
ClawSecure identified 7 findings in karakeep, concentrated in Data Exfiltration, Policy Violation and Unauthorized Tool Use. 2 were rated high or critical severity. The most severe include Script accesses environment variables and makes network calls in... and Environment variable access with network calls in....
How was karakeep audited?
ClawSecure ran karakeep through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 3 files from openclaw/skills.
What does a score of 40 mean?
ClawSecure assigned karakeep a security score of 40/100, placing it in the Warning range. This is driven by 7 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for karakeep
ClawSecure detected 7 security findings in karakeep, spanning Data Exfiltration, Policy Violation, Unauthorized Tool Use and Permissions Manifest.
- critical · Script accesses environment variables and makes network calls in.... Data Exfiltration finding detected in
/tmp/url-scans/14b963e5f7e8c64d/scripts/karakeep-cli.py. - critical · Environment variable access with network calls in.... Data Exfiltration finding.
- medium · Pattern detected: import requests. Data Exfiltration finding detected in
scripts/karakeep-cli.py:5. - medium · Skill code uses network libraries but doesn't declare network.... Unauthorized Tool Use finding.
- medium · Script iterates through environment variables in.... Data Exfiltration finding detected in
/tmp/url-scans/14b963e5f7e8c64d/scripts/karakeep-cli.py. - medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
- info · Skill manifest does not include a 'license' field. Specifying a license.... Policy Violation finding detected in
SKILL.md.
Each finding is expandable in the interactive list below.
3-Layer Audit Protocol
Security Recommendations for karakeep
Audit external network connections
Resolve policy violations
Add a config.json permissions manifest
Related Security Research
ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on February 7, 2026. karakeep is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.