XMind Generator

Generate XMind mind map files (.xmind) from Markdown outlines or plain text descriptions. Use when a user asks to create a mind map, visualize a structure, o...

This skill looks like a straightforward Node script that creates .xmind files. Before installing/running: (1) run npm install in a sandboxed or controlled environment (not as root) and review package-lock.json or the 'xmind' package source if you want to audit third-party code; (2) when running, explicitly specify safe input and output paths so the script doesn't read or overwrite files you care about; (3) on Windows, piping from /dev/stdin may not work — prefer --input or --text; (4) if you need stronger assurance, inspect the 'xmind' npm package and transitive dependencies for unexpected network calls or filesystem access.

Type: OpenClaw Skill Name: xmind-generator Version: 1.0.3 The OpenClaw AgentSkills skill bundle for XMind generation appears benign. The `SKILL.md` instructions are clear, directly related to the stated purpose, and do not contain any prompt injection attempts or instructions for the agent to perform unauthorized actions. The `scripts/generate_xmind.js` code uses standard Node.js file operations to read input and write an XMind file, without any network calls, attempts to access sensitive system files, or execute arbitrary commands. While the `path.resolve` function in the script could theoretically be part of a path traversal vulnerability if the OpenClaw agent does not properly sanitize user-provided output paths, the skill's documentation explicitly guides the agent to use the workspace directory, indicating no malicious intent from the skill developer. A minor vulnerability note exists for a deprecated `uuid` dependency, but this is a library issue, not malicious code within the skill itself.