Vikunja Tasks

Manage tasks and projects on a self-hosted Vikunja instance. Use when the user wants to create, view, complete, or manage tasks, check what's due or overdue, list projects, or get task notifications. Also use for to-do lists, reminders, and task tracking.

This skill's code matches its description (it calls a Vikunja server with an API token), but the package metadata fails to declare the sensitive environment variables and runtime dependencies the SKILL.md and script require. Before installing: (1) verify the skill source (the registry lists no homepage), (2) confirm you are comfortable providing VIKUNJA_URL and VIKUNJA_TOKEN and that the token has limited scope, (3) ensure the host has curl, jq, and python3 available (the script uses them), (4) review the included scripts yourself (they are plain shell and appear to call only your Vikunja instance), and (5) be cautious when enabling the suggested cron/notification delivery — it will send task lists to whichever channel you configure (e.g., Telegram). If you cannot verify the source or are uncomfortable providing the token, do not install. Also ask the publisher to update the skill metadata to declare the required env vars and binaries for transparency.

Type: OpenClaw Skill Name: vikunja-tasks Version: 1.0.0 The skill bundle is designed to manage tasks and projects on a self-hosted Vikunja instance. It utilizes `curl` to interact with the user-configured Vikunja API endpoint (`VIKUNJA_URL`) using a provided `VIKUNJA_TOKEN`. All network calls are directed to this specified endpoint, and there is no evidence of data exfiltration to unauthorized external destinations. The `SKILL.md` includes instructions for setting up a cron job with a message to the agent for proactive task notifications, which is a form of prompt injection, but its intent is clearly benign and aligned with the skill's stated purpose of providing task notifications, not to subvert agent behavior or access unrelated sensitive data. The `vikunja.sh` script uses `jq` for JSON parsing and `python3` for URL encoding, which are standard and appropriate practices.