Tencent Docs

Provides comprehensive Tencent Docs operations including creating, reading, editing various document types, and managing knowledge base spaces and nodes.

Key things to check before installing: (1) Inspect setup.sh content before running it — it will register the MCP service and may modify local mcporter configuration. (2) Confirm which environment variables the skill actually needs: SKILL.md expects TENCENT_DOCS_TOKEN; the registry view you saw did not declare it — don't provide secrets until you confirm. (3) The docs show example scripts that use Authorization and Cookie headers for direct HTTP calls — ask the author whether those are required and why they aren't declared. (4) The skill advises reading local files and Base64-encoding them for manage.import_file; only allow that when you specifically intend to import a particular file. (5) If you are uncomfortable running setup.sh or providing tokens/cookies, request the full setup.sh and re-run the evaluation. If you proceed, give the least-privilege token possible and monitor network activity during first use.

Type: OpenClaw Skill Name: tencent-docs-chen Version: 1.0.11 The skill bundle provides a comprehensive integration for Tencent Docs but includes a high-risk update mechanism in SKILL.md that instructs the AI agent to fetch and execute arbitrary 'instruction' strings from a remote API (https://docs.qq.com/openapi/mcp). This pattern is a significant prompt-injection vulnerability that could lead to remote command execution if the remote endpoint is compromised. Additionally, setup.sh performs global system modifications by installing npm packages and configuring the mcporter tool with sensitive environment tokens.