Vikunja Task Api

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 2.5.1

Overview

This appears to be a real Vikunja task-management integration, but it documents broad write/delete/sharing powers and recommends credential persistence in a way users should review carefully.

Install only if you want OpenClaw to manage real Vikunja data, including deletes, bulk edits, sharing, and membership changes. Prefer the packaged helper script over the unpinned curl-to-/usr/local/bin command, use a least-privileged Vikunja API token, store secrets in OpenClaw's secure env or a secret manager rather than ~/.bashrc, and review any delete, share, bulk update, or rights-change command before it runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill metadata declares required binaries and environment variables but does not declare any explicit permissions despite clearly instructing shell execution and authenticated network access. In an agent ecosystem, that mismatch weakens policy enforcement and informed consent because the runtime may grant broader capabilities than users expect.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documents many destructive operations such as delete project, delete task, and similar write actions without cautionary prompts, confirmation guidance, or rollback advice. In an agent context, that increases the risk of accidental destructive changes against a live task-management system.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructions tell users to persist the API token in ~/.bashrc, which exposes long-lived credentials to shell history, local account compromise, accidental dotfile sync, and other processes that source or read the file. For shared or managed environments, this can materially increase credential leakage risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

Save `vikunja.sh` to a directory in your PATH for convenient CLI access:

```bash
curl -sL https://raw.githubusercontent.com/ashanzzz/openclaw-person-skills/main/skills/vikunja-task-api/vikunja.sh \
  -o /usr/local/bin/vikunja && chmod +x /usr/local/bin/vikunja
```

• Confidence: 92% confidence
• Finding: The skill advises downloading and installing an executable script directly from a remote GitHub URL into /usr/local/bin without integrity verification, pinning, or code review. This is a classic supply-chain risk: if the upstream content changes or the repo is compromised, users may execute attacker-controlled code with local privileges.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

```bash
echo 'export VIKUNJA_URL="http://your-vikunja-instance:3456"' >> ~/.bashrc
echo 'export VIKUNJA_TOKEN="tk_your_token"' >> ~/.bashrc
source ~/.bashrc
```

• Confidence: 84% confidence
• Finding: The YARA label overstates this as backdoor persistence, but the underlying issue is real: the skill directs users to persist service URL and API token in ~/.bashrc, creating durable credential exposure. Although not malware, it increases the blast radius of local compromise and the chance of accidental disclosure through backups, dotfile repos, or multi-user access.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.