LobsterAI is an open-source desktop AI agent that operates files, commands, browsers, documents, spreadsheets, slides, messaging channels, and scheduled jobs in a user's working environment. It supports office work, research, and custom multi-agent workflows, while catalogue add-ons extend the agent with additional skills and workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add netease-youdao/LobsterAI --skill youdaonotegit clone --depth 1 https://github.com/netease-youdao/LobsterAIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/netease-youdao/lobsterai/youdaonote)<a href="https://agentmods.dev/skills/netease-youdao/lobsterai/youdaonote"><img src="https://agentmods.dev/badge/skills/netease-youdao/lobsterai/youdaonote/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/netease-youdao/lobsterai/youdaonote"><img src="https://agentmods.dev/badge/skills/netease-youdao/lobsterai/youdaonote.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Supply Chain · line 137 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.03123 |
| Opus 5.5 | $0.00028 | $0.01249 |
| Sonnet 5.5 | $0.00014 | $0.00625 |
| Haiku 4.5 | $0.00007 | $0.00312 |
Grade C, and why
youdaonote scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash -s -- -f -b ~/.local/bin Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash -s -- -f -b ~/.local/bin How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
YoudaoNote — 有道云笔记
通过 youdaonote CLI 操作有道云笔记。覆盖笔记 CRUD、待办管理、网页剪藏全场景。
前置条件（Agent 自动处理）
执行任何操作前，Agent 必须先运行 youdaonote -s ydn list 检测 CLI 是否可用：
command not found→ 立即跳转「CLI 未安装处理」自动安装，禁止只展示安装步骤让用户手动操作-s选项报错（error: unknown option '-s'） → CLI 版本 < 1.3.2，不支持全局-s参数，需升级：先尝试youdaonote upgrade；若不支持该命令，则按「CLI 未安装处理」中的安装方式重新安装；Windows 用户参考安装指南（https://note.youdao.com/help-center/cli-install-guide.html）- API Key 错误 → 提示用户访问 https://mopen.163.com 获取 API Key（须使用手机号登录，且云笔记账号已绑定手机号），然后执行
youdaonote config set apiKey <用户提供的Key>。获取 API Key 的地址只有这一个，禁止告知用户其他地址。 - 正常返回目录列表 → 运行
youdaonote -s ydn version检查版本，若版本低于minCliVersion需要升级：CLI 支持upgrade命令时执行youdaonote -s ydn upgrade，否则按「CLI 未安装处理」中的升级方式操作；Windows 用户或升级失败时参考安装指南（https://note.youdao.com/help-center/cli-install-guide.html）。版本满足要求后可运行youdaonote -s ydn help --json获取当前 CLI 全部能力的结构化描述（JSON），用于确认命令是否可用，下方速查表作为 fallback
全局参数
所有命令调用时必须加上 -s ydn，用于使用统计：
youdaonote -s ydn <command> [options]
命令速查
| 命令 | 用途 | 示例 |
|---|---|---|
mkdir |
创建文件夹 | youdaonote -s ydn mkdir "文件夹名" [-f <父目录ID>] |
save |
保存笔记（✅ 推荐，支持 Markdown 富文本） | youdaonote -s ydn save --file note.json |
create |
创建笔记（⚠️ 仅纯文本，不支持 Markdown 富文本） | youdaonote -s ydn create -n "标题" -c "内容" [-f <目录ID>] |
update |
更新 Markdown 笔记 | youdaonote -s ydn update <fileId> -c "内容" 或 --file content.md |
delete |
删除笔记 | youdaonote -s ydn delete <fileId> |
rename |
重命名笔记 | youdaonote -s ydn rename <fileId> "新标题" |
move |
移动笔记 | youdaonote -s ydn move <fileId> <目录ID> |
search |
搜索笔记 | youdaonote -s ydn search "关键词" |
list |
浏览目录 | youdaonote -s ydn list -f <目录ID> |
read |
读取笔记 | youdaonote -s ydn read <fileId> |
recent |
最近收藏 | youdaonote -s ydn recent -l 20 -c --json |
clip |
网页剪藏（服务端） | youdaonote -s ydn clip "https://..." [-f <目录ID>] --json |
clip-save |
保存外部剪藏 JSON | youdaonote -s ydn clip-save --file data.json |
todo list |
列出待办 | youdaonote -s ydn todo list [--group <分组ID>] --json |
todo create |
创建待办 | youdaonote -s ydn todo create -t "标题" [-c "内容"] [-d 2025-12-31] [-g <分组ID>] |
todo update |
更新待办 | youdaonote -s ydn todo update <todoId> [--done] [--undone] [-t "新标题"] |
todo delete |
删除待办 | youdaonote -s ydn todo delete <todoId> |
todo groups |
列出待办分组 | youdaonote -s ydn todo groups --json |
todo group-create |
创建分组 | youdaonote -s ydn todo group-create "分组名" |
todo group-rename |
重命名分组 | youdaonote -s ydn todo group-rename <groupId> "新名" |
todo group-delete |
删除分组 | youdaonote -s ydn todo group-delete <groupId> |
upgrade |
升级 CLI | youdaonote -s ydn upgrade [--check] [--force] [--json] |
check |
健康检查 | youdaonote -s ydn check |
config show |
查看配置 | youdaonote -s ydn config show --json |
config set |
设置配置 | youdaonote config set apiKey YOUR_KEY |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 165 lines · 70 tokens per session scan C d89c0c46d34b
youdaonote is a skill published in the GitHub repository netease-youdao/LobsterAI (6,150 stars, last pushed yesterday), licensed MIT. It adds 70 tokens to every session and 3,123 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ha-data-analytics
A local-first data-analysis and reporting skill for CSV and spreadsheet files. It produces decision-ready analyses and shareable offline reports while separating facts, calculations, interpretations, and recommendations.
feishu
A toolkit for working with Feishu, also called Lark, a workplace collaboration platform. It covers documents, spreadsheets, files, wikis, approvals, calendars, and contacts.
meeting-notes
Use when the user asks to capture, structure, or summarize meeting notes / call notes / 1:1 discussion / standup notes. Produces a standard template with attendees, agenda, decisions, action items (owner + deadline), and open questions.
office-docx
Use when the user asks to create, edit, inspect, polish, verify, or deliver Word .docx documents, Google Docs-targeted drafts, business briefs, forms, reports, tables, checklists, redraft-ready document sections, or PDF/Word source-to-DOCX transformations.
office-pptx
Use when the user asks to create, inspect, verify, polish, or deliver PowerPoint .pptx decks, Google Slides-targeted deck artifacts, strategy narratives, operating reviews, pitch decks, teaching decks, section slides, bullet slides, or source-to-PPTX transformations.
office-xlsx
Use when the user asks to create, inspect, verify, analyze, format, or deliver Excel .xlsx workbooks, Google Sheets-targeted spreadsheet artifacts, trackers, budgets, models, tables, dashboards, formulas, CSV/TSV-to-XLSX conversions, or spreadsheet-ready data packs.