YoudaoNote

Use when the user wants to interact with YoudaoNote (有道云笔记) — listing, reading, creating, searching notes, clipping web pages, or saving Markdown/mindmap not...

Security Scan

The skill is coherent with a YoudaoNote CLI usage guide, but the runtime instructions ask you to curl|bash a remote install script from an external URL with no registry install metadata or provenance — that raises install-and-execution risk.

Purpose & Capability

Name, description, and SKILL.md all consistently describe using a youdaonote CLI to list, read, create, search, clip, and save notes. Required capabilities described (API key configuration) match the stated purpose; no unrelated service credentials or binaries are requested.

Instruction Scope

Instructions are narrowly scoped to installing and using a youdaonote CLI and configuring an API key. However, the SKILL.md explicitly directs running a remote installer via `curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash`, which grants the remote script authority to write/execute on the host — an out-of-band action beyond the skill’s pure instruction scope and worth caution.

Install Mechanism

There is no registry install spec, but the README instructs piping a shell install script from artifact.lx.netease.com into bash. This is a high-risk pattern: it downloads and executes arbitrary remote code. The URL is not a well-known packaged-release host (e.g., GitHub release or major package manager) in the skill metadata, and the registry listing provides no checksums or signatures to verify the installer.

Credentials

The skill declares no required env vars or credentials. The SKILL.md asks the user to set an API key in the CLI (youdaonote config set apiKey), which is proportional to a note-syncing CLI. There are no requests for unrelated secrets or system-level credentials.

Persistence & Privilege

The skill is instruction-only, does not request always:true, and does not modify other skills or declare config path access. It does rely on installing a third-party CLI which may persist on disk — that persistence is due to the installer (see install_mechanism concern), not the skill metadata.

What to consider before installing

This skill appears to be a genuine usage guide for a YoudaoNote CLI, but the SKILL.md tells you to run a remote install script (curl | bash). That action will execute code from a remote server on your machine — treat it as risky unless you trust the source. Before installing: (1) verify the installer URL belongs to the official vendor (artifact.lx.netease.com appears related to NetEase but confirm official documentation), (2) fetch the script first (curl … -o install.sh) and review its contents and any checksums/signatures instead of piping to bash, (3) prefer installing from a trusted package manager or signed release when available, (4) run the installer in a sandbox/VM if possible, and (5) verify where the CLI stores your API key and what network calls it makes. If you cannot verify the installer's provenance or inspect it safely, avoid running the script.

YoudaoNote CLI

Command-line tool for 有道云笔记. Operate on notes without opening the app — list, read, create, search, clip, and save from the terminal or scripts.

Setup

# Install (no Node.js required)
curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash

# Configure API Key (get from https://mopen.163.com/#/dashboard)
youdaonote config set apiKey YOUR_API_KEY

# Verify
youdaonote list

API Key requires a phone number bound to your YoudaoNote account.

Quick Reference

Goal	Command
List root directory	youdaonote list
List a folder	youdaonote list -f <目录ID>
Read a note	youdaonote read <fileId>
Create a note	youdaonote create -n "标题" -c "内容"
Create empty note	youdaonote create -n "标题"
Search notes	youdaonote search 关键词
Search (JSON output)	youdaonote search "关键词" --json
Recent 15 notes	youdaonote recent
Recent N notes	youdaonote recent -l <N>
Recent with content	youdaonote recent -c
Clip a webpage	youdaonote clip "https://..."
Clip to folder	youdaonote clip "https://..." -f <目录ID>
Save clip JSON	youdaonote clip-save --file result.json
Save note JSON	youdaonote save --file note.json

Save Formats

clip-save JSON (HTML clipping from browser plugins)

{
  "title": "笔记标题",
  "bodyHtml": "<p>正文内容</p>",
  "sourceUrl": "https://example.com",
  "images": []
}

save JSON (Markdown, mindmap, etc.)

{
  "title": "笔记.md",
  "type": "md",
  "content": "# 标题\n\n正文内容"
}

Common Workflows

Search and read in a script:

FILE_ID=$(youdaonote search "关键词" --json | jq -r '.[0].id')
youdaonote read "$FILE_ID"

Save a build report in CI:

cat > note.json << 'EOF'
{ "title": "构建报告.md", "type": "md", "content": "# 构建成功\n\n时间：$(date)" }
EOF
youdaonote save --file note.json

Troubleshooting

Symptom	Fix
API Key 未配置	youdaonote config set apiKey YOUR_KEY
clip-save 报缺少必填字段	JSON 需包含 title、bodyHtml、sourceUrl
save 报缺少必填字段	JSON 需包含 title、content
Unterminated string JSON 解析失败	改用 printf '%s\n' '...' 或 --file 从文件读取
Windows JSON Parse error	使用 --file 读取文件；或改用 PowerShell
Windows clip 后出现命令错误	URL 含 & 时必须用英文双引号括起整个 URL
Windows 保存后乱码	先执行 chcp 65001，或用 UTF-8 编辑器保存 JSON