IELTS Tuyaya Upload 雅思成绩一键上传

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears purpose-aligned for uploading user-selected IELTS review JSON files to tuyaya.online, but users should notice the cloud upload, account login, and local token storage.

Before installing, make sure you are comfortable sending IELTS review data, wrong-question notes, vocabulary, and scores to tuyaya.online. Use the diff step before batch upload, verify the folder being uploaded, and remove the saved token with `--logout` if you are on a shared or untrusted machine.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the wrong directory is chosen, multiple local review records could be uploaded to tuyaya.online.

Why it was flagged

The skill can batch upload local JSON review records to a remote service, but it explicitly calls for a diff and user confirmation first.

Skill content
运行 `--diff ./batch-output/` 展示差量 ... 用户确认后运行 `--batch ./batch-output/` 批量上传
Recommendation

Use the diff step, confirm the directory contents, and only run batch upload on folders intended for tuyaya import.

What this means

The skill gains ongoing access to the user's tuyaya account until the token expires or is removed.

Why it was flagged

The script sends the user's tuyaya username/password to the disclosed service for login and saves the returned token locally for later authenticated uploads.

Skill content
const result = await apiRequest('login', { username, password }); ... saveToken(result.data.token, username);
Recommendation

Use a unique password, avoid shared machines, and run `--logout` or delete `~/.ielts-tuyaya-token` when you no longer want the skill to stay logged in.

What this means

Installation tooling may not warn users that Node.js is needed before the skill can run.

Why it was flagged

The skill requires Node.js even though the registry requirement section declares no required binaries; this is a packaging/metadata gap rather than hidden behavior.

Skill content
Node.js ≥ 18(有原生 fetch)
Recommendation

Confirm Node.js 18 or newer is installed before using the skill, and prefer metadata that declares this runtime requirement.