← Back to Skills Marketplace
tomislavpet

Init Manager

by Tomislav Petrovic · GitHub ↗ · v1.0.1
cross-platform ⚠ suspicious
579
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install init-manager
Description
Manage tasks in Init Manager — pick up ready tasks, update status, comment, and close out. Use when assigned tasks via webhook or cron, or when interacting w...
README (SKILL.md)

Init Manager Skill

This skill enables AI agents to work with Init Manager as a project management backend — picking up tasks, doing work, and closing them out.

Setup

Your workspace needs these in TOOLS.md or environment:

  • Init Manager URL (e.g. https://manager.init.hr)
  • API Key (Bearer token, starts with initm_)
  • Your User ID (UUID)

AI Guides (Instruction Hierarchy)

There are three levels of AI instructions. Always follow them. More specific wins on conflict:

  1. Global AI GuideGET /api/settings?key=ai_global_guide
  2. Per-User AI GuideGET /api/users/\x3Cyour-user-id>aiGuide field
  3. Project AI GuideGET /api/projects/\x3Cproject-id>aiGuide field

On first boot and periodically: fetch all three and follow the combined instructions.

Task Workflow

  1. Pick up tasks in ready status assigned to you
  2. Move to in_progress before starting work
  3. Read full description + all comments + project AI guide before writing code
  4. If unsure — comment asking for clarification, keep in ready, assign to a human
  5. When done — move to done, add comment with commit/PR link + summary
  6. If blocked — comment with details, assign to a human

API Reference

Authentication

All requests need:

Authorization: Bearer initm_\x3Cyour-key>

Key Endpoints

Action Method Endpoint
List projects GET /api/projects
Project board GET /api/projects/\x3Cid>/board
Project details GET /api/projects/\x3Cid>
List tasks GET /api/tasks?assignee=me&status=ready
Get task GET /api/tasks/\x3Cid>
Update task PATCH /api/tasks/\x3Cid>
Move task POST /api/tasks/\x3Cid>/move
Create task POST /api/tasks
Add comment POST /api/tasks/\x3Cid>/comments
Assign user POST /api/tasks/\x3Cid>/assign
Complete assignment POST /api/tasks/\x3Cid>/complete
Activity log GET /api/activity
Global AI guide GET /api/settings?key=ai_global_guide

Create a Task

POST /api/tasks
{
  "projectId": "\x3Cuuid>",
  "title": "Task title",
  "type": "task",           // epic | task | bug
  "status": "backlog",      // backlog | ready | in_progress | done | verified
  "priority": "medium",     // low | medium | high | urgent
  "description": "...",     // plain text or Tiptap JSON
  "parentId": "\x3Cuuid>",     // optional, makes subtask
  "dueDate": "2026-03-01T00:00:00.000Z"
}

Update a Task

PATCH /api/tasks/\x3Cid>
{
  "status": "in_progress",
  "title": "New title",
  "priority": "high"
}

All fields optional — only include what changes.

Add a Comment

POST /api/tasks/\x3Cid>/comments
{
  "body": "Your comment text"
}

⚠️ Use body field, not content.

Assign a User

POST /api/tasks/\x3Cid>/assign
{ "userId": "\x3Cuuid>" }

Labels

GET    /api/labels?projectId=\x3Cuuid>
POST   /api/labels                        { "name": "Bug", "color": "#ef4444", "projectId": "\x3Cuuid>" }
POST   /api/tasks/\x3Cid>/labels             { "labelId": "\x3Cuuid>" }
DELETE /api/tasks/\x3Cid>/labels             { "labelId": "\x3Cuuid>" }

Behavior Notes

  • Assignments auto-complete when task moves to done or verified
  • Moving task back to ready/backlog clears notification flags and assignment completion
  • Comments created via API are flagged viaApi: true
  • Task keys (e.g. IMG-32) are auto-generated from project prefix

Error Responses

{ "error": "Description" }
Status Meaning
400 Bad request / validation
401 Invalid or missing API key
403 Not allowed for your role
404 Resource not found
409 Conflict
500 Server error

Common Workflow: Check for Tasks

# Get all projects
curl -H "Authorization: Bearer $KEY" $URL/api/projects

# Check each project board for ready tasks assigned to you
curl -H "Authorization: Bearer $KEY" $URL/api/projects/$PID/board

# Pick up a task
curl -X PATCH -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"status":"in_progress"}' $URL/api/tasks/$TID

# ... do the work ...

# Close it out
curl -X PATCH -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"status":"done"}' $URL/api/tasks/$TID

curl -X POST -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"body":"Done. Commit: https://..."}' $URL/api/tasks/$TID/comments
Usage Guidance
Before installing, verify and be comfortable with these points: (1) The SKILL.md requires an Init Manager URL, an API key (initm_...), and your user UUID, but those are not declared in the registry — expect to provide them in your environment or TOOLS.md. (2) The skill tells the agent to fetch and obey remote 'AI guide' documents (global, per-user, per-project). Those guides can contain arbitrary instructions that the agent is expected to follow — only use the skill with a trusted Init Manager instance and least-privilege credentials. (3) Because this is instruction-only, review the actual aiGuide contents on your Init Manager instance (what they can instruct) and consider testing with a limited-scope API key or in a sandboxed environment with restricted network egress. (4) If you need higher assurance, ask the publisher to: (a) declare required env vars in the registry, (b) document exactly what fields the aiGuide may contain and any safety constraints, or (c) provide a version of the skill that validates/limits remote guide commands before execution.
Capability Analysis
Type: OpenClaw Skill Name: init-manager Version: 1.0.1 The `SKILL.md` file contains explicit instructions for the AI agent to fetch and execute 'AI Guides' from external API endpoints (e.g., `GET /api/settings?key=ai_global_guide`, `GET /api/users/<your-user-id>`, `GET /api/projects/<project-id>`) hosted on `manager.init.hr`. The instruction 'Always follow them' creates a severe prompt injection vulnerability, as a compromised Init Manager instance or an attacker with control over these API responses could inject arbitrary instructions into the AI agent's prompt, potentially leading to unauthorized command execution, data exfiltration, or other malicious activities. This is a critical vulnerability, not direct malice, as the skill itself doesn't contain the malicious payload but provides the mechanism to fetch and execute it.
Capability Assessment
Purpose & Capability
The SKILL.md describes a legitimate Init Manager integration (listing endpoints and workflows) and those capabilities match the skill name/description. However, the registry declares no required environment variables or credentials while the SKILL.md clearly expects an Init Manager URL, an API key (Bearer initm_...), and a user UUID. That mismatch between declared requirements and actual instructions is an inconsistency.
Instruction Scope
Runtime instructions direct the agent to periodically fetch three external 'AI guide' endpoints (global, per-user, per-project) and to 'follow the combined instructions' with precedence rules. This gives the remote service the ability to influence or dictate agent behavior at runtime. The SKILL.md also references environment variables ($KEY, $URL) and instructs reading full task descriptions and comments. Fetching and obeying remote guides is a material behavior that increases risk if the remote host is untrusted.
Install Mechanism
There is no install spec and no code files beyond the SKILL.md and version.txt, so nothing is downloaded or written to disk by the skill itself. Instruction-only skills have lower install risk.
Credentials
Although the registry lists no required env vars, the SKILL.md requires an API key (Bearer token starting with 'initm_'), an Init Manager URL, and a User ID. Requiring a bearer API key is proportionate for a task-management integration, but the fact that these credentials are not declared in the metadata is an omission. Also, because the skill will fetch and follow remote AI guides, providing credentials could enable the remote service to request privileged actions — limit credentials to the minimum necessary.
Persistence & Privilege
always:false (no forced installation) and model invocation is allowed (default). The SKILL.md's 'fetch on first boot and periodically' guidance implies recurring remote calls if the agent is active, which combined with autonomous invocation increases the blast radius of the remote 'AI guides' control model. This is not intrinsically malicious but worth considering.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install init-manager
  3. After installation, invoke the skill by name or use /init-manager
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Expanded and clarified usage instructions in SKILL.md, including required setup and workflow for managing tasks in Init Manager. - Added a detailed guide on AI instruction hierarchy and when to fetch guides. - Provided comprehensive API reference with authentication, endpoints, and example request payloads. - Documented common task workflow, error responses, and implementation-specific behavior notes. - Updated setup section for required environment variables and prerequisites.
Metadata
Slug init-manager
Version 1.0.1
License
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Init Manager?

Manage tasks in Init Manager — pick up ready tasks, update status, comment, and close out. Use when assigned tasks via webhook or cron, or when interacting w... It is an AI Agent Skill for Claude Code / OpenClaw, with 579 downloads so far.

How do I install Init Manager?

Run "/install init-manager" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Init Manager free?

Yes, Init Manager is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Init Manager support?

Init Manager is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Init Manager?

It is built and maintained by Tomislav Petrovic (@tomislavpet); the current version is v1.0.1.

💬 Comments