ClawHub

Yacli Yandex

v1.0.2

Manage Yandex Mail, Disk, and Calendar via yacli MCP: read, search, reply to emails; upload, publish files; view, plan events with explicit user approval for...

⭐ 0· 63·0 current·0 all-time
by@qoderone
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the artifacts: the SKILL.md consistently describes calling a yacli MCP server via mcporter. The included scripts and reference files only check for mcporter/yacli and provide example mcporter wiring. Nothing requests unrelated cloud credentials or unrelated system access.
✓
Instruction Scope
Runtime instructions narrowly direct the agent to call specific MCP tool ids (yacli.mail.*, yacli.disk.*, yacli.calendar.*) and include explicit safety rules (require explicit user approval for sends, publishes, destructive actions). The SKILL.md does not tell the agent to read arbitrary host files or exfiltrate data; it references mcporter config paths only in the expected troubleshooting/validation context.
✓
Install Mechanism
There is no remote download/install spec. The bundle contains helper scripts (check/install) that only validate presence of binaries and print operator steps; they do not fetch or execute code from external URLs. This is low-risk for install-time code execution.
ℹ
Credentials
The skill declares no required env vars or credentials. It expects a host-side yacli MCP server with authenticated Yandex accounts; mcporter.json examples mention YACLI_CONFIG_DIR and a secret backend, which is reasonable. Operators should recognize that sensitive tokens live on the host-side MCP configuration (outside the skill) and secure that hosting environment accordingly.
✓
Persistence & Privilege
always is false and the skill does not request permanent platform-wide privileges or modify other skills. The included scripts only perform local checks and print instructions; they do not alter system-wide agent settings.
Assessment
This skill appears to be what it claims: a thin wrapper that drives a local yacli MCP server via mcporter. Before enabling it, verify that mcporter and yacli are installed on a host you control, and that any Yandex account tokens are stored only in your host-side mcporter/yacli config (not in the skill bundle). Run the included scripts (scripts/check-yacli.sh) locally to confirm the expected MCP tools and account visibility. Be cautious about enabling autonomous agent invocation if you are concerned about the agent sending email or publishing files — the SKILL.md requires explicit user approval for those actions, but you should audit agent policies and logs on the host to ensure behavior matches your expectations.

Like a lobster shell, security has layers — review code before you run it.

latestvk979338brbtvv60ca71n7a7kk983rmad

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments