Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently generates XMind files from user-provided outlines, with only minor dependency and trigger-scope cautions.
Before installing, be aware that this skill runs npm install and creates .xmind files at the chosen output path. Use it for intended mind-map exports, review output paths before running, and consider updating or pinning the xmind dependency chain if you maintain the package.
The description says to use the skill when a user asks to 'create a mind map' or 'visualize a structure,' which are broad phrases that could overlap with many general brainstorming or diagramming requests. The file does not provide exclusion conditions or tighter trigger constraints to distinguish when this skill should activate versus other visualization or note-structuring tools.
The lockfile pins a known vulnerable version of uuid (3.4.0) as a transitive dependency of xmind. The cited issue involves missing buffer bounds checks in certain UUID generation paths when a caller provides a buf argument; while this skill primarily generates XMind files and may not directly expose that API to untrusted callers, the vulnerable package is present in the shipped dependency tree and could be triggered by library code or future code changes.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"license": "ISC",
"type": "commonjs",
"dependencies": {
"xmind": "^2.2.33"
}
}
No suspicious patterns detected.