Trilium

Manage Trilium Notes by reading, searching, and creating notes via the ETAPI with provided server URL and ETAPI token.

This skill legitimately needs two pieces of information to work: TRILIUM_ETAPI_TOKEN (an ETAPI token you generate in Trilium) and TRILIUM_SERVER_URL (the Trilium server address). Before installing: (1) be aware the registry metadata does not list these required env vars or a primary credential — you must provide them manually. (2) The ETAPI token grants API-level access to all notes reachable by that token; only provide it if you trust the skill and the agent's ability to run it. Prefer generating a scoped or ephemeral token if Trilium supports it, and run the Trilium server on a local or private network if you want to keep data internal. (3) Because the skill can be invoked autonomously, any stored token could be used without an extra prompt — consider limiting network access or using a token that has limited permissions. (4) If you need more assurance, request the publisher add the required env vars to the registry metadata and/or include an explicit statement of exactly which ETAPI endpoints the skill will call and when.

Type: OpenClaw Skill Name: trilium Version: 1.0.3 The skill bundle is designed to interact with Trilium Notes via its ETAPI, requiring `TRILIUM_ETAPI_TOKEN` and `TRILIUM_SERVER_URL` from the environment, which is a standard and necessary configuration for an API-driven skill. The `SKILL.md` and `references/api.md` files clearly document the skill's purpose and the API endpoints it uses, all of which align with managing Trilium notes. There is no evidence of prompt injection attempts, data exfiltration, malicious execution, persistence mechanisms, or any other harmful intent within the provided files.