← Back to Skills Marketplace
l-u-c-k-y

Asana

by L-U-C-K-Y · GitHub ↗ · v0.2.0
cross-platform ⚠ suspicious
1790
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install asana-agent-skill
Description
Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT).
README (SKILL.md)

Asana

This skill provides a dependency-free Node.js CLI that calls the Asana REST API (v1) using a Personal Access Token (PAT).

  • Script: {baseDir}/scripts/asana.mjs
  • Auth: ASANA_PAT (preferred) or ASANA_TOKEN
  • Output: JSON only (stdout), suitable for agents and automation

Setup

  1. Create an Asana PAT in your Asana account (Developer Console is not required for PAT usage).
  2. Provide the token to OpenClaw/Clawdbot as ASANA_PAT.

Common injection patterns

  • Shell env (local testing):

    export ASANA_PAT="..."

  • OpenClaw config (recommended): set skills.entries.asana.apiKey (or env.ASANA_PAT) so the secret is injected only for the agent run.

Configure via OpenClaw CLI (recommended)

This is the safest way to set the PAT because it keeps secrets out of prompts and ad-hoc shell history.

Recommended (apiKey → ASANA_PAT):

openclaw config set skills.entries.asana.enabled true
openclaw config set skills.entries.asana.apiKey "ASANA_PAT_HERE"

skills.entries.asana.apiKey is a convenience field: for skills that declare metadata.openclaw.primaryEnv, OpenClaw injects apiKey into that env var for the agent run (this skill’s primary env is ASANA_PAT).

Alternative (explicit env):

openclaw config set skills.entries.asana.enabled true
openclaw config set skills.entries.asana.env.ASANA_PAT "ASANA_PAT_HERE"

Verify what is stored:

openclaw config get skills.entries.asana
openclaw config get skills.entries.asana.enabled
openclaw config get skills.entries.asana.apiKey

Remove a stored token:

openclaw config unset skills.entries.asana.apiKey
# or
openclaw config unset skills.entries.asana.env.ASANA_PAT

Important: sandboxed runs

When a session is sandboxed, skill processes run inside Docker and do not inherit the host environment. In that case, skills.entries.*.env/apiKey applies to host runs only.

Set Docker env via:

  • agents.defaults.sandbox.docker.env (or per-agent agents.list[].sandbox.docker.env)
  • or bake the env into your sandbox image

First calls (sanity + discovery)

  • Who am I:

    node {baseDir}/scripts/asana.mjs me

  • List workspaces:

    node {baseDir}/scripts/asana.mjs workspaces

  • (Recommended) Set a default workspace once:

    node {baseDir}/scripts/asana.mjs set-default-workspace --workspace \x3Cworkspace_gid>

ID resolution

When the user provides names (project/task/user), resolve to GIDs using one of:

  • typeahead --workspace \x3Cgid> --resource_type project|task|user --query "..." (fast, best default)
  • projects --workspace \x3Cgid> --all (enumerate)
  • users --workspace \x3Cgid> --all (enumerate)

Avoid guessing a GID when multiple matches exist.

Core: tasks

List tasks assigned to a user (personal productivity)

node {baseDir}/scripts/asana.mjs tasks-assigned --assignee me --workspace \x3Cworkspace_gid> --all

List tasks in a project

node {baseDir}/scripts/asana.mjs tasks-in-project --project \x3Cproject_gid> --all

Search tasks (Advanced Search API)

Canonical primitive: search-tasks (supports many filters; preferred over adding narrow “search helper” commands).

One-liner example (search within a project):

node {baseDir}/scripts/asana.mjs search-tasks --workspace \x3Cgid> --project \x3Cproject_gid> --text "..." --all

Useful filters:

  • --assignee me|\x3Cgid|email> (maps to assignee.any)
  • --completed true|false
  • --created_at.after \x3Ciso> / --modified_at.after \x3Ciso>
  • --due_on.before YYYY-MM-DD / --due_at.before \x3Ciso>
  • --is_blocked true|false / --is_blocking true|false

Create / update / complete

  • Create:

    node {baseDir}/scripts/asana.mjs create-task --workspace \x3Cgid> --name "..." --projects \x3Cproject_gid> --assignee me

  • Update:

    node {baseDir}/scripts/asana.mjs update-task \x3Ctask_gid> --name "..." --due_on 2026-02-01

  • Complete:

    node {baseDir}/scripts/asana.mjs complete-task \x3Ctask_gid>

Project manager workflows

This skill supports the workflows commonly expected from a PM in Asana:

  • Keep a project brief up to date (upsert-project-brief)
  • Write status updates (create-status-update)
  • Work with timelines (start/due dates) and shift schedules safely
  • Use custom fields as first-class metadata
  • Interpret blockers and dependency graphs (project-blockers, dependencies, dependents)

Project brief

  • Read:

    node {baseDir}/scripts/asana.mjs project-brief \x3Cproject_gid>

  • Upsert (create or update):

    node {baseDir}/scripts/asana.mjs upsert-project-brief \x3Cproject_gid> --title "Project brief" --html_text "\x3Cbody>...\x3C/body>"

Status updates

  • Create:

    node {baseDir}/scripts/asana.mjs create-status-update --parent \x3Cproject_gid> --status_type on_track --text "Weekly update..."

  • List:

    node {baseDir}/scripts/asana.mjs status-updates --parent \x3Cproject_gid> --all

Sections and moving tasks

  • List sections:

    node {baseDir}/scripts/asana.mjs sections --project \x3Cproject_gid> --all

  • Create section:

    node {baseDir}/scripts/asana.mjs create-section --project \x3Cproject_gid> --name "Blocked"

Add a task to a project

Command: add-task-to-project

Calls POST /tasks/{task_gid}/addProject and supports optional section placement and ordering.

Examples:

node {baseDir}/scripts/asana.mjs add-task-to-project \x3Ctask_gid> --project \x3Cproject_gid>

With section + ordering:

node {baseDir}/scripts/asana.mjs add-task-to-project \x3Ctask_gid> --project \x3Cproject_gid> --section \x3Csection_gid> --insert_before null --insert_after null

(--section, --insert_before, and --insert_after are optional; when provided they are passed through in the request body.)

Remove a task from a project

Command: remove-task-from-project

Calls POST /tasks/{task_gid}/removeProject.

Example:

node {baseDir}/scripts/asana.mjs remove-task-from-project \x3Ctask_gid> --project \x3Cproject_gid>

Custom fields

Custom fields are critical for reliable PM automation.

  • List a project’s custom fields:

    node {baseDir}/scripts/asana.mjs project-custom-fields \x3Cproject_gid> --all

  • Read a custom field definition:

    node {baseDir}/scripts/asana.mjs custom-field \x3Ccustom_field_gid>

  • Set task custom fields on create/update:

    node {baseDir}/scripts/asana.mjs update-task \x3Ctask_gid> --custom_fields '{"\x3Ccustom_field_gid>":"\x3Cvalue>"}'

Notes:

  • For enums, the value is typically the enum option GID.
  • For numbers, send a JSON number.

Rich text, mentions, and reliability

Asana rich text fields are XML-valid HTML fragments wrapped in a \x3Cbody> root element. The API rejects invalid XML or unsupported tags.

Key points:

  • Use html_notes for task descriptions.
  • Use html_text for comments/stories and status updates.
  • Avoid unsupported tags like \x3Cp> and \x3Cbr>; prefer literal newlines (\ ) and \x3Chr/> separators.
  • For mentions/links, use \x3Ca data-asana-gid="...">\x3C/a> (or a self-closing \x3Ca .../>).

Mention notifications

Creating a mention link does not guarantee notification delivery if the user is not already assigned or following.

For reliable pings, do one of:

  • Assign the user first, then post the comment, OR
  • Add the user as a follower, wait a few seconds, then post the comment

This skill supports the “add follower + wait” pattern:

node {baseDir}/scripts/asana.mjs comment \x3Ctask_gid> --html_text "\x3Cbody>Hi \x3Ca data-asana-gid=\"\x3Cuser_gid>\"/>...\x3C/body>" --ensure_followers \x3Cuser_gid> --wait_ms 2500

Plain text comments (--text) do not create real @-mentions via the API; they remain plain text.

Attachments, uploads, and inline images

  • Upload a file attachment to a task:

    node {baseDir}/scripts/asana.mjs upload-attachment --parent \x3Ctask_gid> --file /path/to/file.png

  • Embed an existing image attachment inline (tasks + project briefs only):

    node {baseDir}/scripts/asana.mjs append-inline-image --attachment \x3Cattachment_gid> --task \x3Ctask_gid>

Activity feed / “inbox-like” workflows

Asana does not provide a single universal “inbox” API for all notifications. The closest stable primitive is the Events endpoint scoped to a specific resource (project, task, etc.).

Use:

  • events --resource \x3Cgid> to pull incremental changes on a project (or a user's "My Tasks" project)
  • The command stores a sync token locally so subsequent runs fetch only changes

Timeline shifting

  • Shift one task (optionally include subtasks):

    node {baseDir}/scripts/asana.mjs shift-task-dates \x3Ctask_gid> --delta_days 7 --dry_run true

  • Shift an entire project’s tasks:

    node {baseDir}/scripts/asana.mjs shift-project-tasks --project \x3Cproject_gid> --delta_days -3 --dry_run true --all

Run with --dry_run true first, then re-run with --dry_run false.

Out of scope

  • Portfolios (premium) are intentionally omitted.
  • “Bot personality” is not embedded here; configure behavior in your agent prompt.
Usage Guidance
This skill appears coherent and implements only the Asana PAT-based functionality it claims. Before installing: 1) Treat the ASANA_PAT like any API secret — inject it at runtime via OpenClaw's config (skills.entries.asana.apiKey or env injection) rather than pasting it into prompts; 2) Prefer a PAT with the minimal scope you can (or rotate it frequently); 3) Be aware the skill will create/read a local per-user config at ~/.openclaw/skills/asana.json (check that file's contents and filesystem permissions if you want to ensure no secrets are stored there); 4) Review scripts/asana.mjs yourself if you need absolute assurance — network calls go to app.asana.com and behavior is JSON-only; and 5) If you run sandboxed agents, ensure the sandbox Docker env is configured as documented so the token is injected only for runs where you expect it.
Capability Analysis
Type: OpenClaw Skill Name: asana-agent-skill Version: 0.2.0 The skill bundle is classified as suspicious due to its inherent high-risk capabilities, specifically file system access and network communication with sensitive credentials. The `scripts/asana.mjs` script can read arbitrary local files (e.g., via `upload-attachment --file <path>`) and upload them to Asana, and it writes configuration files to the user's home directory. While these actions are plausibly needed for the skill's stated purpose of managing Asana, they represent meaningful high-risk behaviors that could be exploited by a malicious prompt to the AI agent, even though the skill's own documentation (SKILL.md, AGENTS.md) does not contain malicious prompt injection instructions or intent.
Capability Assessment
Purpose & Capability
Name/description require a Personal Access Token and the skill declares ASANA_PAT as its primary env var. The included script(s) call Asana's API (app.asana.com) and implement task/project operations described in the docs — the requested credential and file accesses align with the stated functionality.
Instruction Scope
SKILL.md and README instruct the agent to use ASANA_PAT (or ASANA_TOKEN) and to call the CLI commands in scripts/asana.mjs. The CLI reads/writes a small local config (~/.openclaw/skills/asana.json) for convenience (defaults/contexts/event sync tokens). This is expected for workspace/context persistence, but users should be aware the skill will create/read that file in the home directory.
Install Mechanism
There is no install spec and the repository is instruction+script only (single dependency-free Node ESM script). No remote downloads, no package manager installs, and no unusual installers are present.
Credentials
Only ASANA_PAT (and optional ASANA_TOKEN alias) are required. That matches the described Asana PAT integration. No unrelated environment variables, cloud credentials, or secrets are requested.
Persistence & Privilege
always is false and disable-model-invocation is default. The skill writes only its own local config file(s) under the user's home (~/.openclaw/skills/asana.json and legacy paths). It does not request elevated system-wide privileges or modify other skills' configs.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install asana-agent-skill
  3. After installation, invoke the skill by name or use /asana-agent-skill
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.0
- Added comprehensive documentation in SKILL.md covering setup, authentication (ASANA_PAT), and usage patterns. - Detailed instructions for configuring the skill with OpenClaw, including best practices for secret handling. - Described supported Asana workflows: task management, project briefs, status updates, timelines, custom fields, and dependencies. - Provided command reference examples for core operations (e.g., creating tasks, searching, managing project briefs, custom fields). - Included notes on using Asana rich text/mentions and ensuring notification reliability.
Metadata
Slug asana-agent-skill
Version 0.2.0
License
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Asana?

Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT). It is an AI Agent Skill for Claude Code / OpenClaw, with 1790 downloads so far.

How do I install Asana?

Run "/install asana-agent-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Asana free?

Yes, Asana is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Asana support?

Asana is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Asana?

It is built and maintained by L-U-C-K-Y (@l-u-c-k-y); the current version is v0.2.0.

💬 Comments