☁️ TCED Cloud Drive | 腾讯云企业网盘

腾讯云企业网盘 TCED 集成技能。当用户需要管理企业网盘文件（上传、下载、删除、浏览、搜索），管理空间（列出、切换），或进行账号认证（登录、登出、切换）时使用。触发关键词：企业网盘、网盘、TCED、SMH、文件上传、文件下载、云端文件、个人空间、团队空间。

This skill appears to do what it says: it orchestrates the tced-mcp tool to perform OAuth2 logins and file operations for Tencent TCED/SMH. Before installing/using: - Review the upstream npm package tced-mcp (version 1.0.2) on the npm registry and its source code to confirm it matches expectations and has a reputable publisher. npx/npm execution is a supply-chain risk—lock exact versions as recommended and review changelogs before upgrades. - Understand that OAuth tokens are stored locally at ~/.tced-mcp/auth.json; the included setup script reads that file to verify apiBasePath/panDomain. Ensure that file has restrictive permissions (chmod 600) and that its apiBasePath/panDomain point to the official domains (https://pan.tencent.com and https://api.tencentsmh.cn) to avoid token leakage to rogue endpoints. - The skill expects a desktop/browser environment for the OAuth flow (it starts a local callback server on port 19526 and attempts to open a browser). Do not attempt to run the authorization flow on headless servers unless you understand and accept the alternative flow. - If you have strict security requirements, audit the tced-mcp package and consider hosting an internally reviewed mirror or vendor-verified release rather than running arbitrary npx downloads. Overall, nothing in the skill files indicates unrelated or hidden behavior; the main residual risk is the normal npm supply-chain and handling of OAuth tokens — both of which the documentation itself highlights and gives mitigation advice for.

Type: OpenClaw Skill Name: tced-skill Version: 1.0.0 The skill bundle provides a legitimate integration for Tencent Cloud Enterprise Drive (TCED) via an MCP server. It includes comprehensive security warnings regarding OAuth2 token safety, recommends strict file permissions (600) for the local credentials file (~/.tced-mcp/auth.json), and explicitly advises locking npm package versions to prevent supply chain attacks. The setup script (scripts/setup.sh) and documentation (SKILL.md, api_reference.md) focus on environment validation and official API endpoint verification (pan.tencent.com and api.tencentsmh.cn) without any evidence of malicious intent or data exfiltration.