by 安全扫描
OpenClaw
可疑
medium confidence该技能看似实现了合法的 YouTrack 客户端和发票生成器，但其元数据省略了必需的 API 令牌，一些实现/指令细节不一致——应在信任它使用凭据之前解决此问题。
评估建议
该技能的代码和指令看起来与 YouTrack 交互和生成发票一致，但注册元数据错误地省略了必需的 API 令牌（YOUTRACK_TOKEN）。在安装或运行之前：1) 将 YouTrack 令牌视为秘密——仅提供最低权限令牌，并且最好创建一个专用服务帐户或具有最小范围的令牌。2) 验证注册元数据已更正（它应声明 YOUTRACK_TOKEN 作为必需的凭据/主环境变量）。3) 在沙盒中或使用测试令牌先在本地检查包含的脚本。4) 如果符合您的安全策略，考虑通过 CLI 参数而不是将令牌导出到长期环境变量。5) 注意轻微的代码问题（例如，在 get_issues 中对 urllib.parse.quote 的引用可能需要导入）——将其视为实现错误而非恶意行为。如果元数据仍不一致或您无法验证源，请避免使用真实凭据与此技能。...详细分析 ▾
✓ 用途与能力
Name, description, and included code (youtrack_api.py and invoice_generator.py) align: the skill only targets YouTrack operations (projects, issues, work items, articles) and invoice generation from time tracking.
✓ 指令范围
SKILL.md instructs the agent and user to use a YouTrack permanent token (YOUTRACK_TOKEN) and only describes YouTrack API calls and invoice generation. The runtime instructions do not request unrelated files, system settings, or external endpoints beyond the user's YouTrack instance.
✓ 安装机制
No install spec is provided (instruction-only). Code files are included but nothing is downloaded or executed automatically by an installer. This is low-risk from an installation perspective.
⚠ 凭证需求
SKILL.md and the code clearly require an API token via YOUTRACK_TOKEN (or a --token argument), but the registry metadata lists no required environment variables and no primary credential. That mismatch is an incoherence: the skill will fail without a token and the metadata omission could mislead users into thinking no secrets are needed. Aside from that, requesting a single YouTrack token is proportionate to the described functionality.
✓ 持久化与权限
The skill does not request always:true and does not attempt to modify other skills or system-wide settings. It runs as a normal, user-invoked skill and has no elevated persistence privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/1/28
更新文档：通用实例 URL，纠正 API 令牌生成步骤
● 无害
安装命令
点击复制官方npx clawhub@latest install youtrack-digisal
镜像加速npx clawhub@latest install youtrack-digisal --registry https://cn.longxiaskill.com
技能文档
您可以在下方找到翻译后的 SKILL.md 内容（保留原始 YAML frontmatter 不翻译，代码块和命令行指令不翻译）...