trello-beads — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trello-beads (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Interact with Trello boards and integrate with Beads project management.
.env.local):TRELLO_API_KEY — from https://trello.com/power-ups/adminTRELLO_TOKEN — generated from the same pageTRELLO_BOARD_ID — your board IDTRELLO_LIST_TRIAGE — column name for cards to pull into beads (default: "Triage")TRELLO_LIST_BUGS — bug column name (default: "Bugs")TRELLO_LIST_DONE — done column name (default: "Done")scripts/ directory (see Setup below)When invoked as /trello-beads setup, or when setting up a new project:
mkdir -p scripts
SKILLS_DIR="${SKILLS_DIR:-${CODEX_HOME:-$HOME/.codex}/skills}"
if [[ ! -d "$SKILLS_DIR" ]]; then
SKILLS_DIR="${CLAUDE_HOME:-$HOME/.claude}/skills"
fi
ln -sf "$SKILLS_DIR/trello-beads/scripts/trello-api.sh" scripts/trello-api
ln -sf "$SKILLS_DIR/trello-beads/scripts/trello-pull.sh" scripts/trello-pull
ln -sf "$SKILLS_DIR/trello-beads/scripts/trello-sync.sh" scripts/trello-syncVerify:
./scripts/trello-api help
./scripts/trello-pull helpCopy .env.local.dist if it exists, or create .env.local with:
TRELLO_API_KEY=<your-api-key>
TRELLO_TOKEN=<your-token>
TRELLO_BOARD_ID=<your-board-id>
TRELLO_LIST_TRIAGE=Triage
TRELLO_LIST_BUGS=Bugs
TRELLO_LIST_DONE=DoneFind your board ID with:
./scripts/trello-api boardsCheck .gitignore contains .env.local to avoid committing secrets.
direnv allow
./scripts/trello-api lists
./scripts/trello-pull list/trello-beads # Show board overview
/trello-beads setup # Set up symlinks and config for a project
/trello-beads triage # List cards in the triage column
/trello-beads pull # Pull all triage cards into beads
/trello-beads pull <card-id> # Pull a specific card into a bead
/trello-beads cards <list-name> # List cards in any column
/trello-beads sync # Update Trello cards from closed beadsShow all lists and card counts:
./scripts/trello-api listsThen for each list with cards, show a summary:
./scripts/trello-api cards-summary "<list-name>"Present as a formatted board overview to the user.
./scripts/trello-pull listShow the cards with their titles, labels, and Trello URLs.
Use the pull script directly:
# Pull all triage cards into beads
./scripts/trello-pull pull
# Pull a specific card
./scripts/trello-pull pull <card-id>
# Pull all and move processed cards to Backlog
./scripts/trello-pull pull-all BacklogThe script handles:
trello-<card-id> as external-ref and trello label to beadsLabel-to-bead mapping:
| Trello Label/Color | Bead Type | Bead Priority |
|---|---|---|
| bug, red | bug | P2 |
| feature, green | feature | P2 |
| minor, yellow | task | P3 |
| (no label) | task | P2 |
Cards from the Bugs column are always type=bug regardless of labels.
./scripts/trello-api cards-summary "<list-name>"
./scripts/trello-api cards "<list-name>" # Full JSONUse the sync script:
./scripts/trello-sync sync # Move cards for closed beads to Done
./scripts/trello-sync sync --dry-run # Preview what would be movedThe script:
bd list --status=closed --label=trellotrello-<card-id> external ref:--dry-run)This avoids per-card API calls for cards already in Done and prevents accidentally unarchiving cards that were archived in other columns.
curl and jq~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.