Process-Diagram-Pro

生成符合行业标准的化工工艺PFD、P&ID、系统架构及数据流图，支持温度渐变和中文显示。

This package appears coherent for its stated purpose, but the source has no homepage and some files were omitted from the review — exercise caution before using in sensitive environments. Recommendations: - Review the remaining files (omitted in the manifest) for any network calls, hard-coded external URLs, or code that reads/writes unexpected system paths. - Run the code in an isolated environment (virtualenv / container) before adding to production. Installing matplotlib/Pillow/numpy is normal; only install the optional 'agent-browser' tool if you need the web-scraping examples. - Note the font loader will look through system font paths and may print them; its __main__ test writes /tmp/font_loader_test.png if executed directly — that behavior is benign but be aware. - If you will handle confidential diagrams, ensure no unexplained telemetry or remote upload is present in the omitted files; request the full source or a signed package from an identifiable author if you need higher assurance.

Type: OpenClaw Skill Name: process-diagram-pro Version: 2.0.0 The core Python logic for generating chemical diagrams (chem_diagram_v3) appears benign and aligns with the stated purpose. However, the SKILL.md file contains highly irregular and risky instructions directing the AI agent to install external software (agent-browser via npm) and browse external URLs (specifically a Feishu/Lark wiki) to 'troubleshoot' or 'research.' This pattern is a significant indicator of an indirect prompt injection vector, where the agent could be manipulated by malicious instructions hosted on the external site. The inclusion of browser-based automation and global package installation instructions is unnecessary and dangerous for a diagramming tool.