Taskqueue

In-memory priority task queue for AI agents. Create tasks with priorities and tags, claim the next highest-priority task, mark tasks complete or failed, filt...

Security Scan

The skill code and instructions match the stated purpose (an in-memory FastAPI task queue); no unrelated credentials, network callbacks, or surprising install sources were found—but it exposes unauthenticated HTTP endpoints, so run only in a trusted/local environment.

Purpose & Capability

Name/description (in-memory priority task queue) align with the included files and required binaries. The code implements task creation, claiming, completion/failure, listing, and stats as documented; required binary is only python and declared pip packages (fastapi/uvicorn/pydantic) are consistent with a FastAPI service.

Instruction Scope

SKILL.md simply instructs running uvicorn on port 8014 and using local HTTP curl endpoints, which matches the code. However, there is no authentication/authorization in the API—endpoints are unauthenticated HTTP—so if the server is reachable from other hosts, anyone who can connect can create/claim/modify tasks.

Install Mechanism

Install metadata indicates pip packages fastapi, uvicorn, pydantic (via the 'uv' pip spec). This is a standard package install from PyPI and proportionate to the service; no downloads from arbitrary URLs or archive extracts are present.

Credentials

The skill requests no environment variables, credentials, or config paths. The code does not access environment variables or external secrets, so requested environment access is minimal and proportional.

Persistence & Privilege

The skill does not request elevated system presence (always:false) and does not change other skills or system configs. Note: running the server opens a network port (8014) with no auth; that is a runtime exposure (not a declared privilege) and should be considered when deciding where to run it.

Assessment

This skill appears to do what it says (an in-memory FastAPI-based task queue). Before installing/running it, consider: (1) The HTTP API has no authentication—only run it on localhost or behind a firewall in a trusted environment; do not expose port 8014 to untrusted networks. (2) It is in-memory only: tasks are ephemeral and lost on process restart. (3) Installation uses common PyPI packages—use a virtual environment and pin package versions if you need reproducible/controlled installs. (4) If you will store any secrets in task payloads, avoid doing so because any process that can reach the server can read them. If you need authenticated or persistent behavior, prefer a queue implementation that supports those features.

Priority task queue for agent workflows.

Start the server

uvicorn taskqueue.app:app --port 8014

Create a task

curl -s -X POST http://localhost:8014/v1/tasks \
  -H "Content-Type: application/json" \
  -d '{"title": "Scan skill", "payload": {"skill": "my-skill"}, "priority": 5, "tags": ["security"]}' | jq

Claim the next task (highest priority first)

curl -s -X POST http://localhost:8014/v1/claim | jq

Returns the task with status changed to running.

Complete or fail a task

curl -s -X POST http://localhost:8014/v1/tasks/TASK_ID/complete \
  -H "Content-Type: application/json" \
  -d '{"result": {"output": "all clear"}}' | jq

curl -s -X POST http://localhost:8014/v1/tasks/TASK_ID/fail \
  -H "Content-Type: application/json" \
  -d '{"error": "scan timed out"}' | jq

List and filter tasks

curl -s "http://localhost:8014/v1/tasks?status=pending" | jq
curl -s "http://localhost:8014/v1/tasks?tag=security" | jq

Queue stats

curl -s http://localhost:8014/v1/stats | jq

Returns total, pending, running, completed, failed.

Endpoints

Method	Path	Description
POST	/v1/tasks	Create a task
GET	/v1/tasks	List tasks (filter: ?status=, ?tag=)
GET	/v1/tasks/{id}	Get task by ID
POST	/v1/claim	Claim next pending task
POST	/v1/tasks/{id}/complete	Mark done with result
POST	/v1/tasks/{id}/fail	Mark failed with error
GET	/v1/stats	Queue statistics