Yuque

Manage Yuque (语雀) knowledge base documents and repositories. Use when users need to interact with Yuque for document operations including reading documents,...

This skill appears to implement a straightforward Yuque API client, but there are coherence issues you should resolve before installing: - Provide a YUQUE_TOKEN: the CLI and SKILL.md require YUQUE_TOKEN, but the registry metadata omitted it. Treat YUQUE_TOKEN as a secret and create a token with the minimum required scope. - Missing helper files: SKILL.md mentions scripts/parse_yuque.py, scripts/search_yuque.py and references/examples.md that are not included. Ask the publisher for the missing files or remove references before relying on those workflows. - Review the included script: scripts/yuque_cli.py uses only the Python standard library and calls only https://www.yuque.com/api/v2. Confirm there are no hardcoded alternate endpoints if you need greater assurance. - If you do not trust the publisher or cannot obtain the missing files, avoid supplying your Yuque token. Consider requesting updated metadata that correctly lists required environment variables (primaryEnv = YUQUE_TOKEN) and a complete file manifest. I have medium confidence in this assessment because the code visible is benign and coherent with the stated purpose, but the metadata/instruction mismatches and missing helper scripts create ambiguity that should be clarified before use.

Type: OpenClaw Skill Name: yuque Version: 1.0.0 The Yuque skill bundle provides a standard integration for managing knowledge base documents via the official Yuque Open API. The core logic in `scripts/yuque_cli.py` uses the `YUQUE_TOKEN` environment variable for authentication and communicates exclusively with `https://www.yuque.com/api/v2`. No evidence of data exfiltration, malicious execution, or prompt injection was found; the missing helper scripts mentioned in `SKILL.md` appear to be documentation inconsistencies rather than indicators of malice.