Vikunja Tasks
v1.0.0Manage tasks and projects on a self-hosted Vikunja instance. Use when the user wants to create, view, complete, or manage tasks, check what's due or overdue, list projects, or get task notifications. Also use for to-do lists, reminders, and task tracking.
⭐ 5· 1.8k·2 current·2 all-time
by@nickian
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill name, description, SKILL.md, and the included script all consistently implement a Vikunja REST API client (list/create/complete tasks, projects, notifications). Requesting a Vikunja URL and API token makes sense for this purpose.
Instruction Scope
The SKILL.md and the script instruct the agent to rely on environment variables VIKUNJA_URL and VIKUNJA_TOKEN and to run the included scripts; but the registry metadata does not declare these env vars. The SKILL.md also recommends adding a cron job using a platform-specific clawdbot command that will deliver notifications to a channel (e.g., Telegram) — this is platform-integrated behavior that should be explicitly documented and consented to.
Install Mechanism
No install spec is present (instruction-only with an included script). This minimizes installer risk because nothing is downloaded or automatically executed by an installer, but the included script will be executed at runtime if invoked.
Credentials
The code and SKILL.md require VIKUNJA_URL and VIKUNJA_TOKEN (sensitive credentials) and rely on external binaries (curl, jq, python3, and date utilities) — yet the registry metadata lists no required env vars or binaries. Requesting a Vikunja API token is appropriate for the described function, but the omission in metadata is a discrepancy that reduces transparency.
Persistence & Privilege
The skill is not forced-always and does not request system-wide configuration changes. The SKILL.md suggests adding a scheduled job (cron) via the platform's clawdbot utility, which is normal for periodic notifications but should be done only with user consent.
What to consider before installing
This skill's code matches its description (it calls a Vikunja server with an API token), but the package metadata fails to declare the sensitive environment variables and runtime dependencies the SKILL.md and script require. Before installing: (1) verify the skill source (the registry lists no homepage), (2) confirm you are comfortable providing VIKUNJA_URL and VIKUNJA_TOKEN and that the token has limited scope, (3) ensure the host has curl, jq, and python3 available (the script uses them), (4) review the included scripts yourself (they are plain shell and appear to call only your Vikunja instance), and (5) be cautious when enabling the suggested cron/notification delivery — it will send task lists to whichever channel you configure (e.g., Telegram). If you cannot verify the source or are uncomfortable providing the token, do not install. Also ask the publisher to update the skill metadata to declare the required env vars and binaries for transparency.Like a lobster shell, security has layers — review code before you run it.
latestvk970r8twgebp4tt5sbn7f489gh802e89
License
MIT-0
Free to use, modify, and redistribute. No attribution required.