Tasktrove

Manage todos via Tasktrove API. Use for listing, creating, completing, or updating tasks. Triggers on task/todo requests like "what's on my todo list", "add a task", "mark X done", "what's due today".

Security Scan

The skill's code and runtime instructions are coherent for a Tasktrove client, but the registry metadata omits required environment variables (TASKTROVE_HOST/TASKTROVE_TOKEN) and the source/homepage are missing — an inconsistency that should be resolved before trusting the skill.

Purpose & Capability

Name/description match the included CLI and API usage. The included script and SKILL.md implement listing, adding, completing, and searching tasks against a Tasktrove API, which is appropriate for the stated purpose. HOWEVER the registry metadata claims no required env vars/credentials while the SKILL.md and script clearly require TASKTROVE_HOST (and optionally TASKTROVE_TOKEN). This metadata omission is an inconsistency.

Instruction Scope

SKILL.md and the CLI script confine actions to calling the Tasktrove API (HTTP requests to TASKTROVE_HOST). Instructions do not request unrelated local files or system state, nor do they instruct exfiltration to external endpoints other than the configured TASKTROVE_HOST.

Install Mechanism

There is no install spec; the skill is instruction-only with a small Python CLI included. Nothing is downloaded from external URLs or installed automatically.

Credentials

The skill legitimately needs TASKTROVE_HOST and may use TASKTROVE_TOKEN for auth — those are proportional to its function. The concern is that the registry lists no required env vars/primary credential while both the SKILL.md and scripts/tasks.py require TASKTROVE_HOST (the script exits if it's missing) and optionally use TASKTROVE_TOKEN. That mismatch reduces transparency and could mislead users about what secrets/config are needed.

Persistence & Privilege

The skill does not request permanent presence (always=false), does not modify other skills or global agent configuration, and does not request elevated privileges.

What to consider before installing

This skill appears to implement a legitimate Tasktrove client, but the registry metadata does not declare environment variables that the skill actually requires. Before installing or using it: 1) Confirm the skill's origin — source/homepage are missing. 2) Expect to set TASKTROVE_HOST (required) and optionally TASKTROVE_TOKEN; the script will send your token and requests to whatever host you configure, so only point it at a trusted Tasktrove instance. 3) Review the included scripts/tasks.py yourself (it's short and readable) to verify there are no surprises. 4) Ask the publisher to correct the metadata so required env vars/primary credential are declared. If you cannot verify the source, treat the skill as higher risk and avoid supplying real credentials.

Tasktrove Todo Management

Manage tasks via a self-hosted Tasktrove instance. (GitHub)

Configuration

Set the following environment variable:

export TASKTROVE_HOST="http://your-server:3333"

Optionally, if your instance requires authentication:

export TASKTROVE_TOKEN="your-api-token"

Quick Reference

Using the CLI script

# List today's tasks
python3 scripts/tasks.py list --today

# List overdue tasks
python3 scripts/tasks.py list --overdue

# List this week's tasks
python3 scripts/tasks.py list --week

# Add a task
python3 scripts/tasks.py add "Task title" --due 2026-02-10 --priority 2

# Complete a task (use ID prefix from list output)
python3 scripts/tasks.py complete abc123

# Search tasks
python3 scripts/tasks.py search "keyword"

Direct API calls

List Tasks

curl -s "$TASKTROVE_HOST/api/v1/tasks"

Create Task

# Note: API requires all fields including id, completed, labels, etc.
curl -X POST "$TASKTROVE_HOST/api/v1/tasks" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "<uuid>",
    "title": "Task title",
    "priority": 4,
    "dueDate": "2026-02-06",
    "completed": false,
    "labels": [],
    "subtasks": [],
    "comments": [],
    "createdAt": "2026-02-06T12:00:00.000Z",
    "recurringMode": "dueDate"
  }'

Complete/Update Task

# Note: PATCH goes to collection endpoint with ID in body (not /tasks/{id})
curl -X PATCH "$TASKTROVE_HOST/api/v1/tasks" \
  -H "Content-Type: application/json" \
  -d '{"id": "<task-id>", "completed": true}'

Delete Task

curl -X DELETE "$TASKTROVE_HOST/api/v1/tasks/<task-id>"

Task Schema

Field	Type	Notes
id	string	UUID (required on create)
title	string	Required
description	string	Optional
completed	boolean	Default false
priority	number	1 (highest) to 4 (lowest)
dueDate	string	YYYY-MM-DD format
projectId	string	UUID of project
labels	string[]	Array of label UUIDs
subtasks	object[]	Nested subtasks
recurring	string	RRULE format

Priority Levels

• P1: Urgent/critical
• P2: High priority
• P3: Medium priority
• P4: Low priority (default)

Notes

• The Tasktrove UI supports natural language input, but the API expects structured JSON
• PATCH operations use the collection endpoint with ID in the request body
• POST requires all schema fields to be present