Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

XM

v1.0.0

XMind to Markdown 转换 | XMind to Markdown Converter. 将 XMind 思维导图转换为 Mermaid/PlantUML 流程图 | Convert XMind mind maps to Mermaid/PlantUML flowcharts. 零依赖 Python...

0· 17·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to be a 'zero-dependency Python script' converter and documents a concrete script path (scripts/xmind2md.py). However, the package contains no code files and the declared requirements list no 'python' binary. A converter would legitimately require the script and a Python runtime; both are missing. This is an incoherence between stated purpose and actual contents.
!
Instruction Scope
SKILL.md instructs the agent to run a local script against user-supplied XMind files and to read/display the converted text. Those steps are appropriate for a converter, but the instructions reference a file that does not exist in the skill bundle. The instructions do not attempt to contact external services (good), but they do direct local file access and execution of a script that isn't present — a significant gap.
!
Install Mechanism
There is no install spec (instruction-only), which is low-risk in itself. But the README-style instructions promise a bundled Python script; since no code is present and nothing will be written to disk by the skill, the lack of an install mechanism means the documented runtime won't work. This mismatch should be resolved (either include the script or document how it is obtained/installed).
Credentials
The skill requests no environment variables or credentials, which is proportionate for a local file converter. However, it fails to declare that the 'python' executable is required; the agent/user will need Python on PATH to follow the instructions. Also note: converting user XMind files requires access to those files — expected, but verify user consent.
Persistence & Privilege
The skill is not always-enabled, requests no persistent permissions, and does not modify other skills or system settings. Model invocation is allowed (platform default), which is appropriate for a callable conversion utility.
What to consider before installing
Do not install or run this skill as-is. SKILL.md refers to a local Python script (scripts/xmind2md.py) but the skill bundle contains no code and does not declare that Python is required. Before proceeding, ask the publisher to: (1) provide the missing scripts or a clear, trusted install mechanism; (2) document the exact Python version required and any runtime behaviors (network access, telemetry, file writes); and (3) supply a homepage or source repository so you can inspect the script contents. If you must run conversions now, prefer running a script you downloaded from a verifiable repository and review it locally to ensure it doesn't exfiltrate data or execute unexpected operations. If the author supplies the script and it matches the documented behavior (no network calls, only local file read/write), the skill would become coherent and likely benign.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🧠 Clawdis
latestvk971953pgr7pzpmd5qhy3q8ran85cmnb
17downloads
0stars
1versions
Updated 5h ago
v1.0.0
MIT-0

XMind to Markdown 转换

概述

将 XMind 思维导图文件转换为多种 Markdown 流程图格式。

  • 零依赖:仅使用 Python 标准库
  • 5种输出格式:mermaid、plantuml、markdown、numbered、styled
  • 完全兼容:与 xmind2md-mcp Node.js 版本输出完全一致

快速参考

任务方法
转换为 Mermaidpython scripts/xmind2md.py file.xmind mermaid
转换为 PlantUMLpython scripts/xmind2md.py file.xmind plantuml
转换为 Markdown 列表python scripts/xmind2md.py file.xmind markdown
带编号流程图python scripts/xmind2md.py file.xmind numbered
带样式流程图python scripts/xmind2md.py file.xmind styled

使用场景

  • 当用户需要将 XMind 文件转换为可嵌入文档的流程图时
  • 当用户需要分析 XMind 思维导图结构时
  • 当用户需要将思维导图内容以文本形式展示时

脚本位置

scripts/xmind2md.py

使用方法

# 基本用法
python scripts/xmind2md.py <xmind_file> [format]

# 默认输出 mermaid 格式
python scripts/xmind2md.py test.xmind

# 指定输出格式
python scripts/xmind2md.py test.xmind mermaid
python scripts/xmind2md.py test.xmind markdown
python scripts/xmind2md.py test.xmind plantuml
python scripts/xmind2md.py test.xmind numbered
python scripts/xmind2md.py test.xmind styled

支持的输出格式

格式说明适用场景
mermaidMermaid 流程图GitHub/GitLab Markdown、文档嵌入
plantumlPlantUML UML 图需要更正式的 UML 表示
markdownMarkdown 列表简单层级展示
numbered带编号的 Mermaid复杂结构,需要追踪节点
styled带主题样式的 Mermaid需要视觉美化

执行步骤

当用户请求转换 XMind 文件时:

  1. 确认文件路径 - 获取用户提供的 XMind 文件路径
  2. 选择输出格式 - 默认使用 mermaid,根据用户需求选择其他格式
  3. 执行转换 - 运行脚本 python scripts/xmind2md.py <file> <format>
  4. 展示结果 - 输出转换后的流程图代码和统计信息

输出示例

Mermaid 格式

graph TD
    node0[需求分析]
    node0_1[用户调研]
    node0 --> node0_1
    node1[竞品分析]
    node0 --> node1

Markdown 列表格式

# 项目规划

- 需求分析
  - 用户调研
  - 竞品分析
- 开发阶段
  - 前端开发
  - 后端开发

Styled 格式

%%{init: {
  "theme": "base",
  "themeVariables": {
    "primaryColor": "#BBF7D0",
    "primaryTextColor": "#065F46"
  }
}}%%

flowchart TD
    classDef default fill:#BBF7D0,stroke:#10B981,stroke-width:2px;
    classDef root fill:#FECACA,stroke:#DC2626,stroke-width:3px;

    node0["需求分析"]
    class 需求分析 root

错误处理

  • 文件不存在:提示用户检查路径
  • 格式无效:自动使用默认 mermaid 格式
  • 文件损坏:提示 XMind 文件可能损坏

技术细节

  • XMind 文件实际是 ZIP 格式,包含 content.xmlcontent.json
  • 支持 XMind 新版(JSON)和旧版(XML)两种格式
  • 特殊字符(引号、换行、管道符)会被自动转义
  • Windows 系统下脚本会自动设置 UTF-8 输出编码
  • 输出与 xmind2md-mcp Node.js 版本完全一致

Comments

Loading comments...