← Back to Skills Marketplace
Tencent Docs
by
jason-aka-chen
· GitHub ↗
· v1.0.11
· MIT-0
419
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install tencent-docs-chen
Description
Provides comprehensive Tencent Docs operations including creating, reading, editing various document types, and managing knowledge base spaces and nodes.
Usage Guidance
Key things to check before installing: (1) Inspect setup.sh content before running it — it will register the MCP service and may modify local mcporter configuration. (2) Confirm which environment variables the skill actually needs: SKILL.md expects TENCENT_DOCS_TOKEN; the registry view you saw did not declare it — don't provide secrets until you confirm. (3) The docs show example scripts that use Authorization and Cookie headers for direct HTTP calls — ask the author whether those are required and why they aren't declared. (4) The skill advises reading local files and Base64-encoding them for manage.import_file; only allow that when you specifically intend to import a particular file. (5) If you are uncomfortable running setup.sh or providing tokens/cookies, request the full setup.sh and re-run the evaluation. If you proceed, give the least-privilege token possible and monitor network activity during first use.
Capability Analysis
Type: OpenClaw Skill
Name: tencent-docs-chen
Version: 1.0.11
The skill bundle provides a comprehensive integration for Tencent Docs but includes a high-risk update mechanism in SKILL.md that instructs the AI agent to fetch and execute arbitrary 'instruction' strings from a remote API (https://docs.qq.com/openapi/mcp). This pattern is a significant prompt-injection vulnerability that could lead to remote command execution if the remote endpoint is compromised. Additionally, setup.sh performs global system modifications by installing npm packages and configuring the mcporter tool with sensitive environment tokens.
Capability Assessment
Purpose & Capability
The skill's name, description, and large reference docs all describe Tencent Docs operations (create/read/edit docs, spaces, sheets, etc.), which is coherent. However the registry metadata shown to you earlier claims no required env vars or primary credential, while the SKILL.md frontmatter and metadata declare a primaryEnv TENCENT_DOCS_TOKEN and a tokenUrl — this mismatch is inconsistent and should be resolved.
Instruction Scope
SKILL.md is detailed and stays within the Tencent Docs MCP domain for API calls. It does instruct the agent to: run setup.sh to register the MCP service; call the MCP endpoint for update checks and tool calls; use scrape_url to fetch arbitrary webpages when a user provides a URL; and to read and Base64-encode local files when importing. Reading local files for the import workflow is coherent with import_file functionality, but any instructions that tell the agent to access local files or to prefer one scraping path for all URLs increase the attack surface and should be followed only with user consent. The docs also mention using Authorization and Cookie headers in example scripts — those credentials are not declared in the registry metadata.
Install Mechanism
There is no formal install spec (instruction-only), which is low-risk, but the package includes a setup.sh script (1520 bytes) that the SKILL.md instructs the user to run to register the MCP service. Running arbitrary setup scripts can change local agent configuration; review the script contents before executing and only run it if you trust the source.
Credentials
SKILL.md metadata clearly expects a TENCENT_DOCS_TOKEN (primaryEnv) and describes using Authorization and Cookie headers in example scripts. Yet the registry summary you were shown lists no required env vars/credentials. Requiring a single Tencent Docs token is reasonable for this skill, but the undeclared mention of Authorization/Cookie headers and the mismatch between registry and SKILL.md are red flags: the skill may need additional secrets or cookies not declared in the registry metadata.
Persistence & Privilege
always:false (good). The setup.sh script will register an MCP service with the local mcporter tool, which is a normal deployment step for an MCP-based integration but does modify local agent tooling state. The skill is allowed to be invoked autonomously (disable-model-invocation:false) — this is platform default and not itself a reason to block, but combined with undeclared credential instructions it widens potential impact. Review what setup.sh writes/changes before running.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tencent-docs-chen - After installation, invoke the skill by name or use
/tencent-docs-chen - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.11
Updated description to English
Metadata
Frequently Asked Questions
What is Tencent Docs?
Provides comprehensive Tencent Docs operations including creating, reading, editing various document types, and managing knowledge base spaces and nodes. It is an AI Agent Skill for Claude Code / OpenClaw, with 419 downloads so far.
How do I install Tencent Docs?
Run "/install tencent-docs-chen" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Tencent Docs free?
Yes, Tencent Docs is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Tencent Docs support?
Tencent Docs is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Tencent Docs?
It is built and maintained by jason-aka-chen (@jason-aka-chen); the current version is v1.0.11.
More Skills