siyuan-export

思源笔记文档导出工具。将思源笔记文档导出为 Word(docx) 格式，支持按文档 ID/路径/名称搜索导出，图片自动打包进文档。支持单个文档导出和批量导出子文档。触发词：导出文档、导出 Word、siyuan export、思源导出、批量导出、导出子文档

This skill largely does what it promises (export SiYuan notes to .docx) and uses only Python stdlib, but take these precautions before using it: 1) The skill needs your SiYuan API token (SIYUAN_TOKEN) even though the registry metadata doesn't list it — treat that as required and keep the token secret. 2) Prefer keeping SIYUAN_BASE_URL as the default localhost (http://127.0.0.1:6806); do not point it to an unknown remote server (that would let that remote host receive requests authenticated with your token). 3) Review the script yourself or run it in a controlled environment — the script builds SQL queries via string interpolation from user input (search keywords, IDs), which can cause unexpected queries; avoid running it with untrusted or automated inputs unless you sanitize them. 4) Store token via environment variables rather than a plaintext config.json in shared locations. 5) If you need higher assurance, request that the publisher correct the registry metadata to declare required env vars and provide a verified homepage/source, or run the script locally after manual code review.

Type: OpenClaw Skill Name: siyuan-export Version: 1.0.2 The script `scripts/siyuan_export.py` contains multiple SQL injection vulnerabilities where user-provided inputs (search keywords, document IDs, and paths) are directly interpolated into SQL query strings sent to the local Siyuan Note API. While the tool's functionality aligns with its stated purpose of exporting notes to Word format, these security flaws allow for potential manipulation of the local database. No evidence of intentional malice, such as data exfiltration to external domains or remote code execution, was detected.