Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vanillaflava/tasknotes-skill --skill tasknotesgit clone --depth 1 https://github.com/vanillaflava/tasknotes-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vanillaflava/tasknotes-skill/tasknotes)<a href="https://agentmods.dev/skills/vanillaflava/tasknotes-skill/tasknotes"><img src="https://agentmods.dev/badge/skills/vanillaflava/tasknotes-skill/tasknotes/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vanillaflava/tasknotes-skill/tasknotes"><img src="https://agentmods.dev/badge/skills/vanillaflava/tasknotes-skill/tasknotes.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.06070 |
| Opus 5.5 | $0.00048 | $0.02428 |
| Sonnet 5.5 | $0.00024 | $0.01214 |
| Haiku 4.5 | $0.00012 | $0.00607 |
Grade A, and why
tasknotes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 476 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TaskNotes
Multi-modal task management for Obsidian TaskNotes vaults. The skill probes the environment first and routes to the best available access method.
Step 0 - Environment probe
Run before any operation. Determines which path to take.
Bundled help: This skill includes references/tasknotes-help.md with step-by-step setup instructions, full API endpoint reference, and troubleshooting for all failure modes. Read it yourself when connection or setup issues arise, and share the relevant sections with the user to guide them through fixes.
1. MCP available?
Run tool_search("tasknotes"). If tasknotes: tools load successfully, the MCP server is live.
If they do not load, do not conclude the server is down. Since plugin v4.13.0 the MCP endpoint requires a bearer token, and a client configured without one fails at connect time, so the tools never appear at all. Check 2 below - a 401 there means the server is running and the client is simply unauthenticated.
2. HTTP API available?
Attempt web_fetch("http://127.0.0.1:8080/api/health"). Three outcomes, and they mean different things:
| Response | Meaning |
|---|---|
{"status":"ok",...} |
HTTP API is live and the request is authenticated |
401 {"success":false,"error":"Authentication required"} |
Server is running; the request carries no API token |
| Connection refused or timeout | Server is not running on that port |
On a 401: the surface exists but is unusable until requests carry Authorization: Bearer <token> (plugin v4.13.0+). If you can set headers, the token is at Settings → TaskNotes → Integrations → HTTP API → API authentication token; ask the user for it and retry. Never read it out of the plugin's data.json. If you cannot, tell the user their client config is missing the token and point them at references/tasknotes-help.md. Do not quietly fall through to the filesystem path. That hides a one-line misconfiguration and silently costs the user filtered queries, time tracking, Pomodoro and per-instance recurring completion. Say what is missing.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +18 lines 0b59a40d4bba
- 1mo ago First seen · 458 lines · 120 tokens per session scan A 5216f1bc1fd1
tasknotes is a skill published in the GitHub repository vanillaflava/tasknotes-skill (17 stars, last pushed 25d ago), licensed MIT. It adds 120 tokens to every session and 6,070 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
manage-glue-workers
Use when managing engineers who naturally gravitate toward glue work (onboarding, documentation, unblocking, process improvement) and need protection from burnout, visibility for their impact, and career development that doesn't force them off the IC track. Trigger phrases include "my report does too much glue", "how…
commitments
Use to track what the user has promised — to their manager, execs, partner teams — and to keep those promises from silently going stale. Trigger phrases include "what have I committed to", "add a commitment", "I promised X by Friday", "am I overcommitted", "help me say no to this", "I need to renegotiate a deadline".…
link-audit
Use when the user wants to audit vault link health, find broken wikilinks, orphaned notes, or semantic clusters. Triggers on "link audit", "broken links", "orphaned notes", "link health", "graph cleanup", or "find orphans".
obsidian-cli
Interact with Obsidian vaults using the Obsidian CLI to read, create, search, and manage notes, tasks, properties, and more. Also supports plugin and theme development with commands to reload plugins, run JavaScript, capture errors, take screenshots, and inspect the DOM. Use when the user asks to interact with their…
moc-update
Use after creating a new Engineering/ note to suggest which Maps of Content (MOCs) it belongs in. Triggers on "update MOC", "add to MOC", "which MOCs", or when the user has just created an Engineering/ note.
journal
Use when the user wants to work with their daily note — view today's entry, add a log, do a daily review, or capture quick thoughts. Covers all daily note workflows.