Movedone

Manage Movedone kanban projects, columns, tasks, comments, and task links via the local HTTP API.

Security Scan

The skill is an instruction-only integration with a local Movedone HTTP API and its requirements and instructions are consistent with that purpose.

Purpose & Capability

Name/description (manage Movedone via local HTTP API) align with the declared requirements: curl and two env vars (MOVEDONE_BASE_URL, MOVEDONE_AUTH_TOKEN). Nothing requested appears unrelated to the stated purpose.

Instruction Scope

SKILL.md contains explicit curl examples that only call the configured base URL with the bearer token. Instructions do not reference other files, system paths, or unrelated environment variables.

Install Mechanism

No install spec or code files — instruction-only skill. This is low-risk; it relies on curl being present, which is declared.

Credentials

The only required env vars are MOVEDONE_BASE_URL and MOVEDONE_AUTH_TOKEN, which are appropriate for an HTTP API client. These values are sensitive (the token grants full API access) and the base URL could be set to a remote host if misconfigured, so protect them and ensure the base URL points to your trusted local app.

Persistence & Privilege

always is false and the skill does not request any persistent system changes or other skills' configs. The normal platform default allowing autonomous invocation applies but is not combined with other red flags here.

Assessment

This skill is coherent and limited to calling a Movedone HTTP API. Before installing: (1) Only set MOVEDONE_BASE_URL to a trusted endpoint (ideally localhost as the setup suggests); do not point it at unknown remote services. (2) Treat MOVEDONE_AUTH_TOKEN as a secret — it grants full API access; rotate it if exposed. (3) Be aware the skill can post comments and modify tasks if invoked, so review any agent outputs before allowing autonomous actions. If you need stronger safeguards, avoid enabling autonomous invocation or restrict the agent's ability to call this skill.

Movedone Skill

Manage Movedone kanban projects, columns, tasks, comments, and task links directly from OpenClaw.

Setup

1. Download the Movedone desktop app: https://movedone.ai/#download
2. In Movedone, open Settings > OpenClaw
3. Enable the HTTP API and copy the base URL and bearer token
4. Set environment variables:

   export MOVEDONE_BASE_URL="http://127.0.0.1:5613"
   export MOVEDONE_AUTH_TOKEN="your-bearer-token"
   

Usage

All commands use curl to hit the local Movedone HTTP API.

List projects

curl -s "$MOVEDONE_BASE_URL/projects" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Create a project

curl -s -X POST "$MOVEDONE_BASE_URL/projects" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Launch Plan","defaultTemplate":true}'

Get a project with columns and tasks

curl -s "$MOVEDONE_BASE_URL/projects/{project_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Rename a project

curl -s -X PATCH "$MOVEDONE_BASE_URL/projects/{project_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Renamed Project"}'

Delete a project

curl -s -X DELETE "$MOVEDONE_BASE_URL/projects/{project_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Create a column

curl -s -X POST "$MOVEDONE_BASE_URL/projects/{project_id}/columns" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title":"Blocked"}'

Rename a column

curl -s -X PATCH "$MOVEDONE_BASE_URL/columns/{column_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title":"In Review"}'

Delete a column

curl -s -X DELETE "$MOVEDONE_BASE_URL/columns/{column_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Search tasks

curl -s "$MOVEDONE_BASE_URL/tasks/search?projectId={project_id}&query=bug" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Get a task

curl -s "$MOVEDONE_BASE_URL/tasks/{task_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Create a task

curl -s -X POST "$MOVEDONE_BASE_URL/tasks" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "columnId":"{column_id}",
    "title":"Write release notes",
    "description":"Summarize the user-facing changes.",
    "priority":"high",
    "tags":["release","docs"]
  }'

Update a task

curl -s -X PATCH "$MOVEDONE_BASE_URL/tasks/{task_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title":"Write final release notes",
    "description":"Include HTTP API updates.",
    "priority":"medium",
    "tags":["release","docs"],
    "aiStatus":"ready"
  }'

Move a task

curl -s -X POST "$MOVEDONE_BASE_URL/tasks/{task_id}/move" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "toColumnId":"{target_column_id}",
    "newPosition": 2
  }'

Delete a task

curl -s -X DELETE "$MOVEDONE_BASE_URL/tasks/{task_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

List comments on a task

curl -s "$MOVEDONE_BASE_URL/tasks/{task_id}/comments" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Add a comment to a task

curl -s -X POST "$MOVEDONE_BASE_URL/tasks/{task_id}/comments" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-Agent-Name: OpenClaw" \
  -d '{"content":"Finished the API integration and started verification."}'

List task links

curl -s "$MOVEDONE_BASE_URL/tasks/{task_id}/links" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Add a task link

curl -s -X POST "$MOVEDONE_BASE_URL/tasks/{task_id}/links" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "targetTaskId":"{target_task_id}",
    "linkType":"depends_on"
  }'

Remove a task link

curl -s -X DELETE "$MOVEDONE_BASE_URL/tasks/{task_id}/links/{target_task_id}" \
  -H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
  -H "Content-Type: application/json"

Notes

• Project, column, and task IDs can be discovered with the list and get commands above
• The base URL and bearer token provide full access to your local Movedone HTTP API, so keep them secret
• Use the X-Agent-Name header to identify the agent when adding comments (defaults to "Agent" if omitted)
• Use add_comment to append progress notes, status updates, working commentary, or intermediate results; do not overwrite the task description for that purpose
• Supported task link types are depends_on, blocks, and related