Verk Task Management

Manage tasks, projects, and workflows in Verk — AI-powered task management. Create, update, assign, and track tasks. Add comments, change status, list automa...

This skill is largely what it says (a Node-based CLI wrapper for Verk), but there is a red flag you should clear before installing or using it: the bundled CLI defaults to an AWS API Gateway domain (execute-api...) rather than the Verk domain referenced in the README. That means your VERK_API_KEY and organization data will be sent to that endpoint unless you set VERK_API_URL to a verified Verk endpoint. Steps to reduce risk: - Verify the correct Verk API base URL with Verk/support or official docs. Do not assume the execute-api URL belongs to Verk. - If you proceed, use a Verk API key with the minimal permissions needed (or a throwaway/test org/key) and monitor its use. - Inspect network logs or use a proxy to confirm where requests actually go when the CLI runs. - Consider editing the script to hardcode the official Verk API_URL (if confirmed) or require VERK_API_URL to be explicitly set before sending requests. - Ask the publisher (owner ID) for provenance: where did the execute-api endpoint come from, and is it an official Verk-hosted gateway? Given the mismatch, do not provide production credentials until you confirm the endpoint is legitimate.

Type: OpenClaw Skill Name: verk Version: 1.1.0 The OpenClaw Verk skill is a straightforward client for the Verk API. It securely handles `VERK_API_KEY` and `VERK_ORG_ID` environment variables for authentication with the legitimate Verk API endpoint (`https://c0x9lrm7ih.execute-api.us-east-1.amazonaws.com/v1`). The `verk-cli.mjs` script uses Node.js `fetch` for network requests and `JSON.stringify` for request bodies, mitigating common injection risks. The `SKILL.md` and `README.md` provide clear, non-malicious instructions for the AI agent and user, without any evidence of prompt injection attempts to subvert the agent, data exfiltration, or other harmful behaviors.