Security audit
vikunja-kanban
Security checks for vulnerabilities and agentic risk
Overview
The skill's code and instructions behave like a normal Vikunja kanban integration, but the package metadata omits required secret/config declarations and SKILL.md references missing files—this mismatch and a few loose references merit caution before installing.
Before installing: (1) Confirm the manifest should declare a required VIKUNJA_TOKEN and add it to the skill metadata or decline installation if it doesn't — the scripts will fail otherwise. (2) Verify the API host (https://kanban.pigpen.haus) is the expected/official endpoint for your team. (3) Use a dedicated, minimum-permission token (shorter lifetime if possible) rather than a broad long-lived token; rotate/revoke if suspicious. (4) Inspect or supply the secrets/vikunja.env file locally — do not commit it to source control. (5) Note SKILL.md references scripts/nc-status-board.sh which is not included; confirm any external fallback logic before relying on this skill in production. (6) If you lack confidence in the domain or token storage, run the scripts in a sandbox and monitor network traffic or use a throwaway token first.
SkillSpector findings are pending for this release.