← Back to Skills Marketplace
132
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install yunxiao-mcp
Description
Use when needing to query or update Yunxiao work items, comments, projects, or organization members from OpenClaw.
Usage Guidance
This skill appears to implement a legitimate Yunxiao integration, but take these precautions before installing or running it:
- Expect to provide YUNXIAO_ACCESS_TOKEN (and optionally YUNXIAO_ORG_ID). The registry metadata omitted this; verify the token is required and how it's used.
- The CLI will run `npx -y alibabacloud-devops-mcp-server` at runtime. That dynamically downloads and executes an npm package (not pinned). Review the alibabacloud-devops-mcp-server package on npm/GitHub and confirm you trust its source before allowing the skill to run.
- The child process inherits the full environment. Avoid running this skill in an environment that contains unrelated secrets (AWS keys, other API tokens). Prefer running in a minimal/isolated environment or agent workspace containing only the Yunxiao token.
- If you prefer to reduce risk, install and audit the alibabacloud-devops-mcp-server package locally (pin its version), or modify the skill to call a vetted, pinned binary instead of using npx.
- If you need a final sign-off: ask the publisher to correct the registry metadata to list YUNXIAO_ACCESS_TOKEN as a required env var, and to document/pin the MCP-server dependency (or include an explicit install spec).
Capability Analysis
Type: OpenClaw Skill
Name: yunxiao-mcp
Version: 1.0.0
The skill provides a legitimate interface for interacting with Alibaba Cloud Yunxiao (DevOps platform) by wrapping the 'alibabacloud-devops-mcp-server'. The implementation in 'scripts/yunxiao-mcp.cjs' uses secure process spawning to communicate with the MCP server via JSON-RPC and correctly handles sensitive credentials through environment variables. No evidence of data exfiltration, malicious instructions, or command injection vulnerabilities was found.
Capability Assessment
Purpose & Capability
The name, README, SKILL.md and scripts all implement a Yunxiao (云效) MCP CLI that queries/updates work items, comments, projects and members — this matches the described purpose. However the registry metadata reported "Required env vars: none" while SKILL.md and the code require YUNXIAO_ACCESS_TOKEN (and optionally YUNXIAO_ORG_ID). That metadata omission is an incoherence that should be corrected/clarified.
Instruction Scope
SKILL.md instructions restrict activity to Yunxiao operations and recommend storing org-specific mappings locally. The runtime instructions and CLI commands in scripts perform only API calls via the alibabacloud-devops-mcp-server. There is no instruction to read unrelated system files. Note: SKILL.md references optional local files (~/.cursor/mcp.json and AGENTS.md) for configuration—these are local-only suggestions, not required remote calls.
Install Mechanism
There is no formal install spec, but the code spawns `npx -y alibabacloud-devops-mcp-server` at runtime. That means the skill will dynamically download and run an npm package (un-pinned) when used. Dynamic installs from npm at runtime increase risk compared with a bundled/pinned dependency because the fetched code could change between runs and execute arbitrary code on the host.
Credentials
The only required secret for the skill's stated purpose is a Yunxiao access token (YUNXIAO_ACCESS_TOKEN), which is proportionate. However: (1) the registry metadata does not declare this required env var (inconsistent), and (2) when the skill spawns the MCP server it passes a copy of the entire process.env (env: { ...process.env, YUNXIAO_ACCESS_TOKEN: ACCESS_TOKEN }). That means any other environment variables (other credentials/secrets present in the agent runtime) will be available to the child process (the npx-installed package), creating a potential for unintended secret exposure.
Persistence & Privilege
The skill does not request always:true, does not modify other skills' configs, and has no explicit install spec that writes system-wide files. The main persistent behavior is that npx may cache the downloaded npm package locally; otherwise the skill does not request elevated or permanent platform privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install yunxiao-mcp - After installation, invoke the skill by name or use
/yunxiao-mcp - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial public release of yunxiao-mcp skill.
- Provides command-line utilities for querying and updating Yunxiao (云效) work items, comments, projects, and organization members.
- Supports commands for listing organizations, searching projects/work items, fetching item details, managing comments, and retrieving organization members.
- Includes user scenarios, environment variable setup, and error handling instructions.
- All private IDs, project mappings, and internal conventions are excluded from public documentation and should be kept locally.
Metadata
Frequently Asked Questions
What is 阿里云云效mcp对接?
Use when needing to query or update Yunxiao work items, comments, projects, or organization members from OpenClaw. It is an AI Agent Skill for Claude Code / OpenClaw, with 132 downloads so far.
How do I install 阿里云云效mcp对接?
Run "/install yunxiao-mcp" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is 阿里云云效mcp对接 free?
Yes, 阿里云云效mcp对接 is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does 阿里云云效mcp对接 support?
阿里云云效mcp对接 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created 阿里云云效mcp对接?
It is built and maintained by 文宁 (@n-wen); the current version is v1.0.0.
More Skills