The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/vikunja_tool.py executes a local sibling tool (joplin_tool.py) using subprocess.run to facilitate task synchronization.
Evidence: The _call_joplin function constructs a command list starting with ["uv", "run", ...] to call the target script.
Analysis: The command is executed using a list format without a shell, which mitigates argument injection risks. This is a standard and acceptable integration pattern for cross-skill communication.
[EXTERNAL_DOWNLOADS]: The skill declares dependencies on reputable Python packages in scripts/pyproject.toml and uses httpx for network communication.
Dependencies: httpx, click.
Analysis: These are well-known, established libraries used according to their intended purposes (network requests and CLI parsing). Network operations are limited to user-configured API endpoints and local services.
[CREDENTIALS_UNSAFE]: The skill manages API tokens via a local configuration file.
Evidence: The script reads api_token and token from agent_config.toml for authenticating with Vikunja and Joplin services.
Analysis: This approach aligns with the platform's standard security practices for secret management, avoiding hardcoded credentials while maintaining necessary authentication for the target services.

vikunja