test

Manage Trello boards, lists, and cards via the Trello REST API.

Security Scan

The skill is an instruction-only Trello helper that only needs your Trello API key and token and uses curl + jq to call Trello endpoints; a few small metadata and declarative inconsistencies are present but nothing suggests covert behavior.

Purpose & Capability

Function (manage Trello via REST) matches the required env vars (TRELLO_API_KEY, TRELLO_TOKEN) and the documented curl calls. Minor inconsistencies: top-level registry metadata lists this skill as 'test' / slug 'testjeff' while SKILL.md and _meta.json identify it as 'trello'; _meta.json ownerId differs from the registry ownerId. These look like packaging/name mismatches, not functional mismatches.

Instruction Scope

SKILL.md explicitly instructs only to run curl against api.trello.com and to use jq to filter results. It only reads the declared environment variables (TRELLO_API_KEY, TRELLO_TOKEN) and does not reference other system paths or external endpoints.

Install Mechanism

No install spec; instruction-only skill (no files executed/written). This is the lowest-risk install model.

Credentials

Only two environment variables are required (TRELLO_API_KEY and TRELLO_TOKEN) which are appropriate for Trello API access. The SKILL.md warns that the key/token provide full access. No unrelated secrets are requested.

Persistence & Privilege

always is false and the skill is user-invocable; autonomous invocation is allowed by default (normal for skills) but there is no request for persistent agent-wide privileges or modifications to other skills.

Assessment

This skill appears to do what it says: run curl against Trello using your TRELLO_API_KEY and TRELLO_TOKEN. Before installing: (1) remember these credentials grant full Trello access—only provide tokens you trust the agent with and consider creating limited/expiring tokens where possible; (2) verify you have curl and jq available (SKILL.md uses curl but only jq is listed as a required binary); (3) the package metadata shows inconsistent names/owner IDs—if provenance matters to you, confirm the publisher/slug before trusting the skill; (4) if you do not want the agent to make API calls autonomously, disable autonomous invocation or avoid setting long-lived tokens. Revoke the token if you stop using the skill.

Trello Skill

Manage Trello boards, lists, and cards directly from Clawdbot.

Setup

1. Get your API key: https://trello.com/app-key
2. Generate a token (click "Token" link on that page)
3. Set environment variables:

   export TRELLO_API_KEY="your-api-key"
   export TRELLO_TOKEN="your-token"
   

Usage

All commands use curl to hit the Trello REST API.

List boards

curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}'

List lists in a board

curl -s "https://api.trello.com/1/boards/{boardId}/lists?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}'

List cards in a list

curl -s "https://api.trello.com/1/lists/{listId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id, desc}'

Create a card

curl -s -X POST "https://api.trello.com/1/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \
  -d "idList={listId}" \
  -d "name=Card Title" \
  -d "desc=Card description"

Move a card to another list

curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \
  -d "idList={newListId}"

Add a comment to a card

curl -s -X POST "https://api.trello.com/1/cards/{cardId}/actions/comments?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \
  -d "text=Your comment here"

Archive a card

curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \
  -d "closed=true"

Notes

• Board/List/Card IDs can be found in the Trello URL or via the list commands
• The API key and token provide full access to your Trello account - keep them secret!
• Rate limits: 300 requests per 10 seconds per API key; 100 requests per 10 seconds per token; /1/members endpoints are limited to 100 requests per 900 seconds

Examples

# Get all boards
curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN&fields=name,id" | jq

# Find a specific board by name
curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | select(.name | contains("Work"))'

# Get all cards on a board
curl -s "https://api.trello.com/1/boards/{boardId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, list: .idList}'