Yapi

Query and sync YApi interface documentation. Use when user mentions "yapi 接口文档", YAPI docs, asks for request/response details, or needs docs sync. Also trigg...

This skill appears to do what it says: call the yapi CLI (or use the @leeguoo/yapi-mcp npm package) and read your YApi config/auth files to fetch and sync interface docs. Before installing or using it: (1) confirm you trust the @leeguoo/yapi-mcp package (inspect its npm/GitHub source) because the fallback uses npx which runs remote code; (2) be aware the skill reads ~/.yapi/config.toml and ~/.yapi-mcp/auth-*.json (these can contain tokens) — avoid running it with highly privileged accounts unless you trust the environment; (3) if you want to reduce runtime risk, preinstall a vetted yapi CLI or a pinned version of the npm package instead of using npx -y; (4) expect the docs-sync commands to create/update .yapi/*.json files in your project directory — review those outputs before committing them.

Type: OpenClaw Skill Name: yapi Version: 1.0.1 The skill is classified as suspicious due to its reliance on `npx -y` to download and execute an external package (`@leeguoo/yapi-mcp`) from npm, which introduces a supply chain risk. Additionally, the skill instructs the agent to read local configuration files (`~/.yapi/config.toml`) using `rg` and perform file write operations during documentation synchronization, granting significant file system access. While these actions are aligned with the stated purpose of YApi documentation management, they represent high-risk capabilities that could be exploited by a compromised `npx` package or a sophisticated prompt injection, even though the `SKILL.md` itself does not contain explicit malicious instructions.