ProcessOn Diagram Generator
v2.3.1A fast diagramming tool developed by ProcessOn that allows you to quickly create beautiful, editable visual diagrams such as flowcharts, swimlane diagrams, s...
⭐ 1· 189·0 current·0 all-time
byying zhang @po@leilizhang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description claim a ProcessOn diagram generator and the skill includes a Python client that talks to smart.processon.com and requires a PROCESSON_API_KEY — this is consistent and proportionate to the stated purpose.
Instruction Scope
SKILL.md explicitly instructs the agent to (a) extract/optimize prompts and (b) when generating architecture diagrams to read entry files, routes, core config and key modules. Reading project files is coherent for producing architecture diagrams, but it means local source/config may be sent to ProcessOn's APIs as part of the prompt/DSL — a potential privacy/exfiltration risk that users should be aware of.
Install Mechanism
No install spec; code is included as a script in the skill. No remote downloads or archive extraction are used by the skill itself, so installation risk is low.
Credentials
Only one credential is required (PROCESSON_API_KEY), which matches the described external API use. However, because the skill instructs the agent to read local project/config files and sends content to an external API, granting the API key can enable uploading potentially sensitive local data to ProcessOn.
Persistence & Privilege
Skill is not always-enabled, does not request additional system privileges, and does not modify other skills. It does save rendered images to ./outputs/processon, which is scoped to the user's working directory.
Assessment
This skill appears to do what it says: it calls ProcessOn endpoints and needs PROCESSON_API_KEY. Before installing, confirm you trust smart.processon.com with any project text or config you may allow the skill to read. Avoid feeding secrets (API keys, private keys, database credentials, or other sensitive configs) into prompts or letting the agent auto-collect files you don't want uploaded. If you only want a local DSL (no network rendering), use the provided --no-render mode or review the generated DSL before triggering rendering. Note that images are saved under ./outputs/processon by default. If you need higher assurance, inspect the full script locally to confirm what data it sends, or run the script in an isolated environment.Like a lobster shell, security has layers — review code before you run it.
latestvk974h50ggbvr3c196vs0gkrcgn84ynpf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.