siyuan-api

Local SiYuan API integration for notebook/document/block/asset operations and SQL search. Uses only local HTTP endpoints and environment-based token auth.

This skill is coherent with its stated purpose, but it requires your SiYuan API token which grants broad read/write access to your notes, files, and assets. Before installing: (1) only set SIYUAN_API_URL to a localhost address (127.0.0.1/localhost) unless you intentionally want remote access; (2) keep SIYUAN_API_TOKEN secret and don't paste it into chat; (3) consider using a temporary or limited token if possible; (4) be cautious about autonomous agent actions—if you enable the agent to call skills automatically, review actions that create, modify, or export documents; and (5) revoke the token if you suspect misuse. If you need stronger assurance, ask the publisher for signed source or an official integration rather than a generic instruction-only skill.

Type: OpenClaw Skill Name: siyuan-api Version: 1.4.3 The skill provides a comprehensive interface to the local SiYuan note-taking API, granting the agent high-risk capabilities such as arbitrary file read/write operations, SQL query execution, and network proxying. While these features are aligned with the stated purpose of notebook management and the SKILL.md includes security warnings, the inclusion of the 'forwardProxy' and 'pandoc' endpoints in the reference documentation (references/api.md) provides a significant attack surface that could be used to bypass the 'local-only' scope or execute arbitrary commands. The broad authority over the local filesystem and database via the API constitutes a high-risk capability without evidence of direct malice.