ClawHub

PikaBoard

v1.0.3

Interact with PikaBoard task management API. Use when creating, updating, listing, or managing tasks. Agent-first kanban for AI teams. Triggers on: tasks, kanban, board, todo, backlog, sprint.

⭐ 1· 1.6k·2 current·2 all-time
by@angelstreet
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (PikaBoard API / kanban) match the actual requirements: node/npm, cloning a GitHub repo, building backend/frontend, and using a local API token. There are no unrelated credentials or binaries requested.
✓
Instruction Scope
SKILL.md and helper scripts focus on installing/running the PikaBoard server, configuring PIKABOARD_TOKEN, and mapping an agent to a board. The scripts only read/write the repo, .env, optional BOARD_ENV_FILE, and call the PikaBoard API. They do not attempt to read unrelated system files or exfiltrate other secrets.
ℹ
Install Mechanism
Installation is instruction-driven and clones https://github.com/angelstreet/pikaboard then runs npm install / build. Cloning from GitHub is expected, but running npm install/build can execute arbitrary install/build scripts from dependencies — this is normal for Node projects but is a point of execution risk that users should accept consciously.
✓
Credentials
The only secrets in play are the PIKABOARD_TOKEN (API auth) and local DB path, which are appropriate for a self-hosted API. The skill does not request unrelated cloud credentials or other tokens.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated system-wide privileges. It may write an optional BOARD_ENV_FILE (to a user-specified path) and its own backend/.env; this is reasonable for onboarding agents to boards.
Assessment
This skill appears to be what it says: a self-hosted PikaBoard integration. Before installing, verify you trust the GitHub repository since the install steps clone it and run npm install/build (npm scripts can run arbitrary code). Running the backend will open a local server (default port 3001) protected by PIKABOARD_TOKEN — treat that token as a secret. Consider running the service in an isolated environment/container, review the repo code if you need higher assurance, and avoid exposing the API to untrusted networks. If you do not trust the remote repo or want to avoid running build scripts, do not install. Otherwise the skill's behavior and requested inputs are proportionate to its purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bpkn26tsqadsjcj2ffcybxn80y0yr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📋 Clawdis
Binsnode, npm

Comments