weeek-tasks
v1.0.0Управление задачами WEEEK через Public API (Task Manager): получать список задач, создавать/обновлять/завершать задачи, перемещать между досками/колонками, получать список досок и колонок. Использовать при интеграции с WEEEK API и работе с задачами/досками/колонками.
⭐ 1· 1.6k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name/description (WEEEK task manager operations) align with the included script and reference docs: scripts/weeek_api.py implements listing/creating/updating/completing/moving tasks and listing projects/boards/columns against https://api.weeek.net/public/v1. The code and SKILL.md describe the same API endpoints and operations.
Instruction Scope
SKILL.md gives concrete CLI usage and explicitly instructs to set WEEEK_TOKEN (and optionally WEEEK_USER_ID) and to use the provided script. The instructions do not ask the agent to read unrelated files or call unexpected external endpoints — all network calls target the documented Public API base URL. No broad or vague 'gather whatever context you need' language is present.
Install Mechanism
There is no install spec (instruction-only) and no downloads; the package includes a small Python script and a package.json manifest. Nothing in the install surface writes or executes code from arbitrary remote URLs, so install risk is low.
Credentials
The SKILL.md and scripts require a secret: WEEEK_TOKEN (and optionally WEEEK_USER_ID). However, the registry metadata lists 'Required env vars: none' and 'Primary credential: none', which is inconsistent and problematic: the platform may not prompt for or protect the token correctly. Aside from those two variables, no unrelated credentials are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or global agent settings, and has no special persistence or privileged system access. It runs as an on-demand CLI-style script.
What to consider before installing
This skill's code appears to do exactly what its description says (talk to WEEEK Public API), but there is an important metadata mismatch: the script requires WEEEK_TOKEN (and optionally WEEEK_USER_ID) while the registry metadata declares no required env vars/credentials. Before installing or providing secrets: 1) Ask the publisher to correct the registry metadata to list WEEEK_TOKEN as the primary credential so the platform can handle it properly. 2) Verify you trust the publisher (homepage unknown) before supplying an API token. 3) Prefer creating a limited-scope token/account for automation rather than using a personal full-access token. 4) Optionally review the included scripts yourself (they are small) to confirm no unexpected network calls or data exfiltration. If the publisher cannot justify or fix the missing metadata, treat the skill with caution (do not provide high-privilege credentials).Like a lobster shell, security has layers — review code before you run it.
latestvk9716cnm5aamqetyqssax5z9gs80cfpw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.