Shortcut

Manage stories on Shortcut.com kanban boards. Use when creating, updating, or listing tasks/stories on Shortcut project management boards. Supports creating stories with descriptions and types (feature/bug/chore), updating story status, and listing active/completed stories. Includes full checklist task management and comment support.

This skill's code matches its description (it talks to Shortcut's official API and manages stories, tasks, comments), but the package metadata omits important operational requirements. Before installing: 1) Verify you trust the skill author (owner ID provided) because the skill will use your Shortcut API token. 2) Expect to provide SHORTCUT_API_TOKEN (or create ~/.config/shortcut/api-token) — the skill does not declare this in metadata. 3) Ensure curl and jq are available on the agent host (scripts depend on them). 4) Inspect the scripts locally (they're plain bash) to confirm behavior; the scripts write ~/.config/shortcut/workflow-states and may advise adding a source to ~/.bashrc — do not blindly modify your shell rc files. 5) Prefer creating a token with the least privileges necessary and rotate/revoke it if you uninstall or stop using the skill. The omissions in metadata are likely sloppy packaging rather than malicious intent, but they are security-relevant and should be corrected before use.

Type: OpenClaw Skill Name: shortcut Version: 1.4.1 The OpenClaw AgentSkills skill bundle for Shortcut.com is classified as benign. All scripts (`scripts/*.sh`) interact exclusively with the legitimate Shortcut API (`https://api.app.shortcut.com/api/v3`) for managing stories, tasks, and comments. API tokens are securely handled by reading from environment variables or a dedicated configuration file (`~/.config/shortcut/api-token`). The `shortcut-init-workflow.sh` script generates a configuration file (`~/.config/shortcut/workflow-states`) containing environment variable exports for workflow states, which is a standard and transparent configuration practice. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts in `SKILL.md` or `README.md` that would subvert the agent's intended behavior or access unrelated sensitive data. All operations are clearly aligned with the stated purpose of integrating with Shortcut.com.