Yuque 语雀知识库管理

This skill appears to be a genuine Yuque API client, but pay attention to these points before installing: - The skill needs your Yuque API token even though the registry metadata didn't declare it. Expect to provide a token. - The agent will (by instruction) create a config.json in the skill directory containing your token in plaintext. If you are uncomfortable storing credentials on-disk, use the YUQUE_TOKEN environment variable or avoid installing the skill. - config.json supports a base_url override. Leave base_url as the default (https://www.yuque.com) unless you explicitly trust another endpoint — changing it could cause the token to be sent elsewhere. - Because the token is stored persistently and the skill can be invoked autonomously, consider whether you want to allow autonomous use, and consider scoping the token (create a token with minimal permissions or revoke it after use). - Practical steps: verify the file contents in the skill folder after setup, prefer using environment variables over disk storage if possible, and revoke the token immediately if you suspect misuse. If you want a stronger assurance, ask the publisher to declare YUQUE_TOKEN (or config.json usage) in the registry metadata and to document any telemetry or external endpoints the skill might contact.