tapd-api

TAPD API 完整集成。实现 18 个模块、70+ API 方法，支持 OAuth 和 Basic Auth 认证。涵盖需求、任务、缺陷、迭代、测试、Wiki、工时等所有 TAPD 功能。

This skill appears to do what it says (a TAPD API client) but consider these points before installing: - Secrets handling: you must provide TAPD clientId/clientSecret (tapd.json or env vars). The skill's metadata does not declare required env vars — follow the SKILL.md. Keep tapd.json out of source control and set file mode to 600 as recommended. - Local token cache: the client saves OAuth tokens to ~/.tapd_token_cache.json in plain JSON. If you are concerned about local token exposure, delete or restrict that file, or run the tool in an isolated environment. - Minor doc inconsistencies: examples reference jq and a tapd_oauth_client.py that isn't present — jq usage is only in examples (jq is not declared as a required binary). Double-check example commands before running them. - Review the code: tapd_client.py performs HTTP requests to https://api.tapd.cn and encodes credentials for OAuth/Basic flows; review it if you need stricter assurance (e.g., to confirm no extra network endpoints or telemetry are present). There is no obfuscation in the code, so a quick audit is straightforward. - Operational hygiene: follow the provided SECURITY.md (do not commit credentials, add tapd.json to .gitignore, rotate keys). Consider running the client in a dedicated account or container if you want to limit blast radius. If you want a safer install, run the scripts in a disposable environment and inspect tapd_client.py yourself; if you need the registry metadata to reflect required env vars/config paths, ask the publisher to update it.

Type: OpenClaw Skill Name: tapd-api Version: 1.0.3 The tapd-api skill bundle is a legitimate and well-documented integration for the TAPD project management platform. The Python client (scripts/tapd_client.py) and shell wrapper (scripts/tapd-api.sh) implement standard OAuth2 and Basic Auth protocols using Python's built-in libraries, with no external dependencies or risky execution sinks like eval() or os.system(). It includes proactive security guidance in SECURITY.md and correctly handles sensitive token caching locally in the user's home directory (~/.tapd_token_cache.json) without evidence of data exfiltration or malicious intent.