云效项目协作工具

• Verdict: Pass
• Confidence: High
• Analyzed: Feb 25, 2026, 11:24 AM
• Findings: 0
• Version: 1.0.2

Overview

The skill's code, instructions, and requested configuration are internally consistent with a Yunxiao (阿里云效) API client — it only requires the expected Yunxiao token and organization ID, installs standard AliCloud SDKs via npm, and caches user IDs locally.

This skill appears to do what it says: talk to Yunxiao using the token and organization ID. Before installing, consider: 1) Do not commit the .env file to VCS and use a least-privilege access token; 2) the tool creates .user-cache.json with name→ID mappings — delete it when not needed (SKILL.md already documents this); 3) npm install will fetch AliCloud SDKs from the public registry — if you require stricter supply-chain controls, audit the dependencies or install in an isolated environment; 4) verify the YUNXIAO_ACCESS_TOKEN you provide has only the scopes you expect and rotate it regularly.