Obsidian Tasknotes
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears purpose-aligned for managing Obsidian TaskNotes through a local API, but it can read, create, update, and delete persistent task data, so users should configure it carefully.
This skill looks coherent for Obsidian TaskNotes management. Before installing, make sure you trust the source, enable a TaskNotes API token, keep the .env file private, and ask the agent to confirm before updating or deleting tasks.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent using this skill can create, modify, or delete tasks in the user's Obsidian vault.
The skill exposes task mutation and deletion operations through the local TaskNotes API. This matches the stated purpose, but these actions can change or remove persistent Obsidian task data.
POST | /tasks | Create task ... PUT | /tasks/{id} | Update task ... DELETE | /tasks/{id} | Delete taskUse update and delete operations only when the user has clearly identified the task and desired action; keep vault backups if task history matters.
If the local TaskNotes API is left unauthenticated, other local processes that can reach the API may be able to access or change tasks.
The skill relies on the TaskNotes HTTP API authentication boundary and supports an optional bearer token. Leaving the API without a token is disclosed, but it weakens protection for an API that can mutate tasks.
API token: leave empty for no auth, or set a token for security ... TASKNOTES_API_KEY=your_token_here
Set a TaskNotes API token, store it only in the intended vault .env file, and avoid exposing the API port beyond localhost.
First use may depend on the local uv environment and whatever compatible dependency versions are resolved at that time.
The helper is an inline uv script with external Python dependencies that are not version-pinned. This is a common setup pattern, but it gives dependency resolution some variability.
#!/usr/bin/env -S uv run --script ... dependencies = ["requests", "python-dotenv"]
Prefer pinning dependency versions and declaring uv as a required binary in metadata for reproducible installation.
Private task information may be surfaced in agent conversations, and task text should be treated as user data rather than trusted instructions.
The skill returns task metadata from the user's Obsidian vault to the agent. This is expected, but task titles, projects, and dates may contain private or user-supplied context.
"tasks": [{ "id": t.get("id"), "title": t.get("title"), "status": t.get("status"), "priority": t.get("priority"), "projects": t.get("projects", []), "due": t.get("due"), "scheduled": t.get("scheduled") }]Avoid storing secrets in task titles/details, and treat retrieved task content as data to summarize or act on only according to the user's request.