Capacities

Manage Capacities notes, daily entries, and weblinks.

Security Scan

The skill is an instruction-only wrapper for the Capacities API and reasonably matches its stated purpose, but the runtime instructions reference an undeclared environment variable and the publisher/source is unknown — verify before installing.

Purpose & Capability

Name and description say 'Manage Capacities notes, daily entries, and weblinks' and the SKILL.md contains curl calls to https://api.capacities.io using a CAPACITIES_API_TOKEN. The requested credential (CAPACITIES_API_TOKEN) is appropriate and proportionate for that purpose.

Instruction Scope

Instructions are limited to making HTTP requests (curl) to capacities.io endpoints for saving daily notes, weblinks, lookups, and space-info. They do not instruct reading local files or unrelated system state. However, the SKILL.md references an optional CAPACITIES_SPACE_ID environment variable that is not declared in the skill metadata, and there are minor inconsistencies in parameter naming (e.g., spaceId vs spaceid).

Install Mechanism

No install spec and no code files — this is instruction-only, so nothing is written to disk or fetched at install time.

Credentials

The declared primaryEnv is CAPACITIES_API_TOKEN which makes sense. But the SKILL.md expects an additional CAPACITIES_SPACE_ID (optional) that is not listed in requires.env. The skill does not request unrelated credentials, however the undeclared env var is a mismatch that should be corrected/clarified.

Persistence & Privilege

always is false and there are no instructions to persist configuration or modify other skills or system settings. The skill could be invoked autonomously (platform default), which is expected for skills of this type.

Assessment

This skill appears to simply call the Capacities API and only needs your Capacities API token — that is coherent with its description. Before installing: 1) Confirm the CAPACITIES_API_TOKEN you provide is a purpose-limited token and not reused for other services. 2) Note the SKILL.md mentions an optional CAPACITIES_SPACE_ID env var but the skill metadata doesn't declare it—if you rely on a specific space, set that env var explicitly or ask the publisher to update the metadata. 3) Verify the endpoints (api.capacities.io) and parameter names against official Capacities docs if possible. 4) The publisher/source is unknown; if you don't trust the publisher, avoid supplying a high-privilege token. If the SKILL.md were to request unrelated credentials, read local files, or include external install/download steps, treat it as suspicious and do not install.

Capacities Skill

Use this skill to interact with your Capacities "Second Brain".

Requirements

• CAPACITIES_API_TOKEN: Obtain from Settings > Capacities API in the desktop app.
• CAPACITIES_SPACE_ID: (Optional) If not provided, the first available space will be used.

Usage

Daily Notes

To add a thought, task, or note to today's daily note: curl -X POST https://api.capacities.io/save-to-daily-note -H "Authorization: Bearer $CAPACITIES_API_TOKEN" -H "Content-Type: application/json" -d '{"spaceId": "$CAPACITIES_SPACE_ID", "mdText": "Your note here"}'

Web Links

To save a URL to your space: curl -X POST https://api.capacities.io/save-weblink -H "Authorization: Bearer $CAPACITIES_API_TOKEN" -H "Content-Type: application/json" -d '{"spaceId": "$CAPACITIES_SPACE_ID", "url": "https://example.com"}'

Search / Lookup

To find an object's ID: curl -X POST https://api.capacities.io/lookup -H "Authorization: Bearer $CAPACITIES_API_TOKEN" -H "Content-Type: application/json" -d '{"spaceId": "$CAPACITIES_SPACE_ID", "searchTerm": "My Note"}'

Space Info

To get all object types and structures: curl -X GET "https://api.capacities.io/space-info?spaceid=$CAPACITIES_SPACE_ID" -H "Authorization: Bearer $CAPACITIES_API_TOKEN"