Vikunja Task Api

Install: clawhub install ashanzzz-vikunja-task-api Full Vikunja v2 API integration — projects, tasks, labels, teams, views, comments, attachments, bulk opera...

This skill appears to do what it says: interact with your Vikunja instance via its API. Before installing, verify the VIKUNJA_URL points to a trusted instance and prefer using an API token (tk_...) with the least privilege you need. Avoid committing tokens to source control; prefer a restricted, non-world-readable env file or a secrets store instead of plain ~/.bashrc if you care about secrecy. If you plan to run the recommended curl to install the helper script, review the script contents (vikunja.sh) first — the skill bundle already includes it, so you can inspect it locally. Finally, only grant the minimal credentials (token or username/password) necessary and be mindful that adding credentials to shell rc files will persist them on the machine.

Type: OpenClaw Skill Name: vikunja-task-api Version: 2.5.1 The skill provides a comprehensive integration with the Vikunja task management API. However, the helper script `vikunja.sh` contains a shell injection vulnerability because it embeds unvalidated command-line arguments (such as task titles or project IDs) directly into double-quoted strings that are subsequently evaluated by the shell during API calls. While this appears to be a functional oversight rather than intentional malware, it allows for arbitrary command execution if the AI agent or a user provides crafted input. The documentation in `SKILL.md` also encourages downloading and executing a script directly from a GitHub repository (ashanzzz/openclaw-person-skills), which is a risky practice.