xmind

This skill appears to do what it says, but proceed cautiously. Key points to consider before installing/using: - Runtime npm execution: The skill runs `npx -y xmind-generator-mcp@0.1.2`, which downloads and executes package code from the npm registry each time. That is expected for this use case but is a supply‑chain risk. Prefer to verify the package contents and publisher before allowing the agent to run it. - No upstream/source info: The skill metadata lists no source repository or homepage. That makes it harder to audit the MCP package. Look up the npm package (xmind-generator-mcp@0.1.2) yourself and inspect its repository, maintainers, and recent changes. - Implicit environment/use of env vars: The SKILL.md mentions an MCP-configured outputPath environment variable but the skill declares no env vars. Verify what outputPath the MCP will use in your environment so files are not written to unexpected locations. - Local file access & chat attachments: The skill will write temp files (/tmp) and may save to ~/Desktop and then send the generated .xmind back in chat. If you have sensitive data on the system, be aware the package you run could read more of the filesystem if malicious. - Mitigations: Run this in a sandboxed environment or container, inspect the npm package source, pin the package to a vetted version, or ask the publisher for a source repo before using. If you cannot verify the npm package or maintainers, treat this skill as higher risk.