← 返回 Skills 市场
132
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install yunxiao-mcp
功能描述
Use when needing to query or update Yunxiao work items, comments, projects, or organization members from OpenClaw.
安全使用建议
This skill appears to implement a legitimate Yunxiao integration, but take these precautions before installing or running it:
- Expect to provide YUNXIAO_ACCESS_TOKEN (and optionally YUNXIAO_ORG_ID). The registry metadata omitted this; verify the token is required and how it's used.
- The CLI will run `npx -y alibabacloud-devops-mcp-server` at runtime. That dynamically downloads and executes an npm package (not pinned). Review the alibabacloud-devops-mcp-server package on npm/GitHub and confirm you trust its source before allowing the skill to run.
- The child process inherits the full environment. Avoid running this skill in an environment that contains unrelated secrets (AWS keys, other API tokens). Prefer running in a minimal/isolated environment or agent workspace containing only the Yunxiao token.
- If you prefer to reduce risk, install and audit the alibabacloud-devops-mcp-server package locally (pin its version), or modify the skill to call a vetted, pinned binary instead of using npx.
- If you need a final sign-off: ask the publisher to correct the registry metadata to list YUNXIAO_ACCESS_TOKEN as a required env var, and to document/pin the MCP-server dependency (or include an explicit install spec).
功能分析
Type: OpenClaw Skill
Name: yunxiao-mcp
Version: 1.0.0
The skill provides a legitimate interface for interacting with Alibaba Cloud Yunxiao (DevOps platform) by wrapping the 'alibabacloud-devops-mcp-server'. The implementation in 'scripts/yunxiao-mcp.cjs' uses secure process spawning to communicate with the MCP server via JSON-RPC and correctly handles sensitive credentials through environment variables. No evidence of data exfiltration, malicious instructions, or command injection vulnerabilities was found.
能力评估
Purpose & Capability
The name, README, SKILL.md and scripts all implement a Yunxiao (云效) MCP CLI that queries/updates work items, comments, projects and members — this matches the described purpose. However the registry metadata reported "Required env vars: none" while SKILL.md and the code require YUNXIAO_ACCESS_TOKEN (and optionally YUNXIAO_ORG_ID). That metadata omission is an incoherence that should be corrected/clarified.
Instruction Scope
SKILL.md instructions restrict activity to Yunxiao operations and recommend storing org-specific mappings locally. The runtime instructions and CLI commands in scripts perform only API calls via the alibabacloud-devops-mcp-server. There is no instruction to read unrelated system files. Note: SKILL.md references optional local files (~/.cursor/mcp.json and AGENTS.md) for configuration—these are local-only suggestions, not required remote calls.
Install Mechanism
There is no formal install spec, but the code spawns `npx -y alibabacloud-devops-mcp-server` at runtime. That means the skill will dynamically download and run an npm package (un-pinned) when used. Dynamic installs from npm at runtime increase risk compared with a bundled/pinned dependency because the fetched code could change between runs and execute arbitrary code on the host.
Credentials
The only required secret for the skill's stated purpose is a Yunxiao access token (YUNXIAO_ACCESS_TOKEN), which is proportionate. However: (1) the registry metadata does not declare this required env var (inconsistent), and (2) when the skill spawns the MCP server it passes a copy of the entire process.env (env: { ...process.env, YUNXIAO_ACCESS_TOKEN: ACCESS_TOKEN }). That means any other environment variables (other credentials/secrets present in the agent runtime) will be available to the child process (the npx-installed package), creating a potential for unintended secret exposure.
Persistence & Privilege
The skill does not request always:true, does not modify other skills' configs, and has no explicit install spec that writes system-wide files. The main persistent behavior is that npx may cache the downloaded npm package locally; otherwise the skill does not request elevated or permanent platform privileges.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install yunxiao-mcp - 安装完成后，直接呼叫该 Skill 的名称或使用
/yunxiao-mcp触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial public release of yunxiao-mcp skill.
- Provides command-line utilities for querying and updating Yunxiao (云效) work items, comments, projects, and organization members.
- Supports commands for listing organizations, searching projects/work items, fetching item details, managing comments, and retrieving organization members.
- Includes user scenarios, environment variable setup, and error handling instructions.
- All private IDs, project mappings, and internal conventions are excluded from public documentation and should be kept locally.
元数据
常见问题
阿里云云效mcp对接 是什么？
Use when needing to query or update Yunxiao work items, comments, projects, or organization members from OpenClaw. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 132 次。
如何安装 阿里云云效mcp对接？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install yunxiao-mcp」即可一键安装，无需额外配置。
阿里云云效mcp对接 是免费的吗？
是的，阿里云云效mcp对接 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
阿里云云效mcp对接 支持哪些平台？
阿里云云效mcp对接 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 阿里云云效mcp对接？
由 文宁（@n-wen）开发并维护，当前版本 v1.0.0。
推荐 Skills