yunxiao-devops

与阿里云云效（Yunxiao）DevOps 平台交互，覆盖八大核心能力：项目协作 Projex、 代码管理 Codeup、流水线 Flow、应用交付 Appstack、制品仓库 Packages、 测试管理 Testhub、效能洞察 Insight、知识库 Thoughts。 当用户提到云效、Projex、Cod...

This skill appears to implement a full Yunxiao/DevOps integration and will need your Yunxiao personal access token and organization ID to work — but the registry entry did not declare those environment variables, so confirm them before enabling. Before installing: (1) Inspect the included scripts (they will clone/push repos, create/delete repositories, merge MRs, trigger pipelines, and post notifications). (2) Provide only least-privilege Yunxiao tokens (avoid permanent tokens). (3) Verify whether you want the skill to read global agent config (~/.openclaw/openclaw.json) — that file may contain other service credentials; prefer explicitly supplying FEISHU_* env vars instead of allowing fallback reads. (4) Run the skill in an isolated environment or audit runtime logs during first runs. (5) Ask the publisher to update registry metadata to list required env vars and explain fallback config reads; if they refuse or cannot justify reading ~/.openclaw/openclaw.json, treat it as higher-risk.

Type: OpenClaw Skill Name: yunxiao-devops Version: 2.5.0 The skill bundle provides a comprehensive suite for Alibaba Yunxiao DevOps automation but contains a hardcoded Personal Access Token (PAT) and Feishu OpenID in `scripts/mr-action.mjs`, which is a major security vulnerability. Additionally, `scripts/bug-fix-flow.mjs` performs high-risk operations including automated SSH key generation, registration of the public key to the Yunxiao platform, and the execution of AI-generated code via Claude Code. While these features are aligned with the stated purpose and include some safeguards (such as privilege dropping to a non-root user), the combination of leaked credentials and broad system/repository access warrants a suspicious classification.