YouTrack Project Management

Interact with YouTrack project management system via REST API. Read projects and issues, create tasks, generate invoices from time tracking data, and manage knowledge base articles. Use for reading projects and work items, creating or updating issues, generating client invoices from time tracking, and working with knowledge base articles.

This skill's code and instructions look coherent for interacting with YouTrack and generating invoices, but the registry metadata incorrectly omits the required API token (YOUTRACK_TOKEN). Before installing or running: 1) Treat your YouTrack token as a secret — only provide a least-privilege token and preferably create a dedicated service account or token with minimal scope. 2) Verify the registry metadata is corrected (it should declare YOUTRACK_TOKEN as a required credential/primaryEnv). 3) Inspect the included scripts locally (they use only your-instance.youtrack.cloud and standard urllib) and run them in a sandbox or with a test token first. 4) Consider passing the token via CLI argument rather than exporting it into a long-lived environment variable if that fits your security policy. 5) Note minor code issues (e.g., a reference to urllib.parse.quote in get_issues may require an import) — treat these as implementation bugs rather than malicious behavior. If the metadata remains inconsistent or you cannot verify the source, avoid using real credentials with this skill.

Type: OpenClaw Skill Name: youtrack-digisal Version: 1.0.1 The skill bundle is benign. The Python scripts (`youtrack_api.py`, `invoice_generator.py`) provide a client for the YouTrack REST API, enabling operations like listing projects/issues, creating issues, and generating invoices from time tracking data. Authentication relies on a YouTrack API token, which is handled securely by reading from an environment variable or argument and used solely for authenticating requests to the specified YouTrack instance. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in the `SKILL.md` that would manipulate the agent beyond its stated purpose.