云效工作项管理

云效项目协作操作助手。支持工作项（任务/需求/缺陷）的查询、创建、更新等操作。当用户提到"云效"、"工作项"、"任务管理"、"项目管理"或需要操作 devops.aliyun.com 时触发。

Security Scan

The skill's code, instructions, and required configuration are coherent with its stated purpose of managing Yunxiao (阿里云效) work items; it reads a local config.json for org/token and calls the OpenAPI endpoints described.

Purpose & Capability

Name/description match the included Python scripts and README: scripts implement listing projects, listing/getting/creating/updating work items against the Yunxiao/OpenAPI host (openapi-rdc.aliyuncs.com). There are no extraneous credentials or unrelated binaries requested.

Instruction Scope

SKILL.md instructs running the provided scripts and includes the same API endpoints and headers used by the code. The runtime instructions do not ask the agent to read unrelated system files or to transmit data to endpoints other than the documented Yunxiao API.

Install Mechanism

No install/download steps are present (instruction-only install). The package contains Python scripts only; nothing is downloaded from arbitrary URLs and no archive extraction occurs.

Credentials

The skill does not declare any required environment variables or primary credential, but it expects the user to populate a local config.json with org_id, token (personal access token), and user_id. The token is used only in the 'x-yunxiao-token' header to the documented OpenAPI host. This is proportionate to the skill's function, but the README/config reliance on a plaintext token file (config.json) is worth noting and securing. Additionally, Python 'requests' dependency is used but not declared in metadata.

Persistence & Privilege

always is false and the skill does not request system-wide persistence or modify other skills. It reads and uses its own config.json in the skill directory; this is expected and scoped to the skill.

Assessment

This skill appears to do what it says: it uses a local config.json to store org_id, user_id and a personal access token and then calls Yunxiao/OpenAPI endpoints. Before installing or using it: - Inspect and, if you accept, populate config.json only with a token that has minimal necessary permissions and not with broader credentials. Treat the token as a secret and store it securely; consider using a short-lived or scoped token when possible. - The token is stored in plaintext in the skill folder; if that is unacceptable, modify the scripts to read the token from a secure secret store or environment variable instead. - Confirm network calls are acceptable — the code sends requests only to https://openapi-rdc.aliyuncs.com (as documented). If you need to audit traffic, run in a controlled environment or inspect requests at runtime. - Ensure Python and the 'requests' package are available in the runtime environment (the skill does not declare dependencies). - Consider rotating the token after first use and revoke it promptly if you remove the skill. If you want stronger guarantees, you can modify the scripts to load the token from an agent-managed secret rather than a plaintext config file. Overall there are no signs of exfiltration or unrelated behavior, but treat the stored token as sensitive.

云效项目协作 API

通过云效 OpenAPI 管理工作项（任务、需求、缺陷等）。

---

🤖 AI 决策指南

用户意图识别

用户说法	意图	执行动作
"查看我的任务" / "我有什么工作项"	查询工作项	指定项目后调用 list_workitems.py
"查看任务详情"	查询单个工作项	调用 get_workitem.py <id>
"创建一个任务" / "新建工作项"	创建工作项	先确认项目，再调用 create_workitem.py
"更新任务" / "修改任务标题"	更新工作项	调用 update_workitem.py
"完成任务" / "关闭任务"	更新状态	调用 update_workitem.py --status
"列出所有项目"	查看项目	调用 list_projects.py

⚠️ 创建任务时的交互流程

重要：创建工作项时，如果用户没有指定项目，必须先询问用户！

1. 用户说："帮我创建一个任务"
2. AI 先查询项目列表：python3 list_projects.py
3. AI 展示可选项目，询问用户："要创建在哪个项目？"
4. 用户选择后，再创建任务

不要在未确认项目的情况下直接使用默认项目创建！

---

📋 命令速查

查询项目列表

python3 ~/.openclaw/workspace/skills/yunxiao/scripts/list_projects.py

查询工作项详情

python3 ~/.openclaw/workspace/skills/yunxiao/scripts/get_workitem.py <workitem_id>

创建工作项

# 必须指定项目
python3 ~/.openclaw/workspace/skills/yunxiao/scripts/create_workitem.py \
  --subject "任务标题" \
  --project "AI 产研"

# 完整参数
python3 ~/.openclaw/workspace/skills/yunxiao/scripts/create_workitem.py \
  --subject "任务标题" \
  --project "AI 产研" \
  --type "任务" \
  --priority "高" \
  --desc "任务描述"

更新工作项

# 修改标题
python3 ~/.openclaw/workspace/skills/yunxiao/scripts/update_workitem.py <id> --subject "新标题"

# 修改描述
python3 ~/.openclaw/workspace/skills/yunxiao/scripts/update_workitem.py <id> --desc "新描述"

---

📁 脚本说明

脚本名	用途
yunxiao_api.py	API 基础模块
list_projects.py	查询项目列表
get_workitem.py	查询单个工作项详情
create_workitem.py	创建工作项（需指定项目）
update_workitem.py	更新工作项
list_workitems.py	查询工作项列表（需指定项目）

---

🔧 API 端点

基础 URL: https://openapi-rdc.aliyuncs.com

认证方式: 请求头 x-yunxiao-token

操作	方法	路径
搜索项目	POST	/oapi/v1/projex/organizations/{orgId}/projects:search
查询详情	GET	/oapi/v1/projex/organizations/{orgId}/workitems/{id}
创建	POST	/oapi/v1/projex/organizations/{orgId}/workitems
更新	PUT	/oapi/v1/projex/organizations/{orgId}/workitems/{id}

---

📝 工作项类型

• 任务 (Task): 开发任务、测试任务等
• 需求 (Req): 产品需求
• 缺陷 (Bug): Bug 修复
• 风险 (Risk): 项目风险

---

⚠️ 权限要求

Token 需要以下权限：

• 项目协作 > 项目 > 只读（查询项目列表）
• 项目协作 > 工作项 > 只读（查询）
• 项目协作 > 工作项 > 读写（创建、更新）

---

最后更新: 2026-03-16