yuque-group-knowledge-report
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses specific tools from the
yuque-mcpserver to fetch organizational data. While it handles internal metrics (member stats, document counts), it operates within the context of an authorized API integration. - [SAFE]: References to 'yuque' resources are recognized as legitimate vendor-owned assets of the Yuque platform (a well-known collaboration service).
- [DATA_EXPOSURE]: Note that the skill requires a Yuque API Token with
statistic:readpermissions. While this is sensitive, the instructions correctly direct users to manage this via the platform's standard MCP server configuration rather than hardcoding credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes document activity and titles from external sources (Yuque). There is a theoretical surface for instructions hidden in document metadata, but since the skill primarily aggregates numerical data for a markdown report, the risk is minimal and mitigated by the agent's core guardrails.
Audit Metadata