知犀思维导图
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill appears to do what it claims—manage Zhixi mind-map cloud files—but it needs a Zhixi API token and can upload user-selected Markdown files, so users should handle the token and imports carefully.
Install only if you trust this skill to access your Zhixi cloud files. Configure the token carefully—code expects ZHIXI_API_KEY or a local token file, despite SKILL.md mentioning ZHIXI_TOKEN—and revoke it if no longer needed. Only import Markdown files you intentionally want uploaded to Zhixi, and treat VIP upgrade prompts as optional commercial guidance.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone with access to the configured token could access Zhixi files according to that token's permissions.
The skill loads a local/environment API token and uses it to authenticate requests to Zhixi. This is expected for cloud file management, but it gives the skill access to the user's Zhixi account data and is under-declared in metadata.
if (process.env.ZHIXI_API_KEY) { ... } ... 'X-Api-Key': CONFIG.authorizationUse a least-privileged/revocable token if Zhixi supports it, avoid sharing the token file, and update the skill metadata/docs to consistently declare ZHIXI_API_KEY.
If the wrong file path is supplied, private local Markdown content could be uploaded into the Zhixi account.
The import command reads a user-specified local Markdown file and uploads it to Zhixi. This is disclosed and purpose-aligned, but it can expose the chosen file's contents to the cloud service.
content = await fs.promises.readFile(inputFile); ... fetch(`${CONFIG.baseUrl}/import/mind`, { method: 'POST', ... body: formData })Only import files the user explicitly selects and consider confirming the filename/path before uploading.
The assistant may steer the user toward a paid Zhixi upgrade when certain API limits are hit.
The skill instructs the assistant to recommend a paid VIP upgrade when a membership restriction occurs. This is disclosed and tied to service limits, but it is commercial guidance.
When error 2001 occurs, guide user to upgrade to VIP to unlock full features
Present upgrade options neutrally, alongside any available free-tier alternatives.