Vikunja Tasks

Manage tasks and projects on a self-hosted Vikunja instance. Use when the user wants to create, view, complete, or manage tasks, check what's due or overdue, list projects, or get task notifications. Also use for to-do lists, reminders, and task tracking.

Security Scan

The skill appears to implement a legitimate Vikunja task manager, but its metadata omits required environment variables and runtime dependencies declared in the instructions and script, which is an inconsistency you should resolve before installing.

Purpose & Capability

The skill name, description, SKILL.md, and the included script all consistently implement a Vikunja REST API client (list/create/complete tasks, projects, notifications). Requesting a Vikunja URL and API token makes sense for this purpose.

Instruction Scope

The SKILL.md and the script instruct the agent to rely on environment variables VIKUNJA_URL and VIKUNJA_TOKEN and to run the included scripts; but the registry metadata does not declare these env vars. The SKILL.md also recommends adding a cron job using a platform-specific clawdbot command that will deliver notifications to a channel (e.g., Telegram) — this is platform-integrated behavior that should be explicitly documented and consented to.

Install Mechanism

No install spec is present (instruction-only with an included script). This minimizes installer risk because nothing is downloaded or automatically executed by an installer, but the included script will be executed at runtime if invoked.

Credentials

The code and SKILL.md require VIKUNJA_URL and VIKUNJA_TOKEN (sensitive credentials) and rely on external binaries (curl, jq, python3, and date utilities) — yet the registry metadata lists no required env vars or binaries. Requesting a Vikunja API token is appropriate for the described function, but the omission in metadata is a discrepancy that reduces transparency.

Persistence & Privilege

The skill is not forced-always and does not request system-wide configuration changes. The SKILL.md suggests adding a scheduled job (cron) via the platform's clawdbot utility, which is normal for periodic notifications but should be done only with user consent.

What to consider before installing

This skill's code matches its description (it calls a Vikunja server with an API token), but the package metadata fails to declare the sensitive environment variables and runtime dependencies the SKILL.md and script require. Before installing: (1) verify the skill source (the registry lists no homepage), (2) confirm you are comfortable providing VIKUNJA_URL and VIKUNJA_TOKEN and that the token has limited scope, (3) ensure the host has curl, jq, and python3 available (the script uses them), (4) review the included scripts yourself (they are plain shell and appear to call only your Vikunja instance), and (5) be cautious when enabling the suggested cron/notification delivery — it will send task lists to whichever channel you configure (e.g., Telegram). If you cannot verify the source or are uncomfortable providing the token, do not install. Also ask the publisher to update the skill metadata to declare the required env vars and binaries for transparency.

Vikunja Task Manager

Manage tasks and projects on a self-hosted Vikunja instance via REST API.

Setup

Set these environment variables:

export VIKUNJA_URL="https://your-vikunja-instance.com"
export VIKUNJA_TOKEN="your-api-token"

Get your API token: Vikunja → Settings → API Tokens → Create token.

Commands

List tasks

{baseDir}/scripts/vikunja.sh tasks --count 10
{baseDir}/scripts/vikunja.sh tasks --project "Shopping" --count 5
{baseDir}/scripts/vikunja.sh tasks --search "groceries"
{baseDir}/scripts/vikunja.sh tasks --sort priority --order desc

Overdue tasks

{baseDir}/scripts/vikunja.sh overdue

Tasks due soon (next N hours)

{baseDir}/scripts/vikunja.sh due --hours 24
{baseDir}/scripts/vikunja.sh due --hours 48

Create a task

{baseDir}/scripts/vikunja.sh create-task --project "Tasks" --title "Buy milk" --due "2026-02-01" --priority 3

Priority: 1 (low) to 5 (urgent). Due date format: YYYY-MM-DD.

Complete a task

{baseDir}/scripts/vikunja.sh complete --id 123

Get task details

{baseDir}/scripts/vikunja.sh task --id 123

List projects

{baseDir}/scripts/vikunja.sh projects

Create a project

{baseDir}/scripts/vikunja.sh create-project --title "New Project" --description "Optional description"

Get notifications

{baseDir}/scripts/vikunja.sh notifications

Due Date Monitoring

To get proactive notifications about due/overdue tasks, set up a cron job:

clawdbot cron add \
  --name "Task due check" \
  --cron "0 9,14 * * *" \
  --tz "America/Denver" \
  --session isolated \
  --message "Check Vikunja for overdue and upcoming tasks (next 24 hours). If any are found, notify me with the list." \
  --deliver \
  --channel telegram

Notes

• Project names in --project are case-insensitive
• Filter expressions follow Vikunja filter syntax (see https://vikunja.io/docs/filters)
• All times are handled in America/Denver timezone