云效工作项管理

云效项目协作操作助手。支持工作项（任务/需求/缺陷）的查询、创建、更新等操作。当用户提到"云效"、"工作项"、"任务管理"、"项目管理"或需要操作 devops.aliyun.com 时触发。

This skill appears to do what it says: it uses a local config.json to store org_id, user_id and a personal access token and then calls Yunxiao/OpenAPI endpoints. Before installing or using it: - Inspect and, if you accept, populate config.json only with a token that has minimal necessary permissions and not with broader credentials. Treat the token as a secret and store it securely; consider using a short-lived or scoped token when possible. - The token is stored in plaintext in the skill folder; if that is unacceptable, modify the scripts to read the token from a secure secret store or environment variable instead. - Confirm network calls are acceptable — the code sends requests only to https://openapi-rdc.aliyuncs.com (as documented). If you need to audit traffic, run in a controlled environment or inspect requests at runtime. - Ensure Python and the 'requests' package are available in the runtime environment (the skill does not declare dependencies). - Consider rotating the token after first use and revoke it promptly if you remove the skill. If you want stronger guarantees, you can modify the scripts to load the token from an agent-managed secret rather than a plaintext config file. Overall there are no signs of exfiltration or unrelated behavior, but treat the stored token as sensitive.

Type: OpenClaw Skill Name: yunxiao Version: 1.0.0 The skill bundle provides a legitimate set of tools for interacting with the Alibaba Cloud Yunxiao (DevOps) platform. The scripts (e.g., yunxiao_api.py, create_workitem.py) facilitate project and task management by making authenticated requests to the official API endpoint (openapi-rdc.aliyuncs.com). The authentication token is stored locally in config.json, and the logic is transparent, lacking any indicators of data exfiltration, obfuscation, or malicious intent.