Mindchart
v1.1.5Create exquisite infographics from user-uploaded files or given text. Used when user requests to create an infographic.
⭐ 1· 279·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (create infographics) match the included artifacts: many template files, a large font file, and two Node scripts (ifgc2svg.js and svg2png.js) that convert the skill's DSL to SVG and then to PNG. The dependencies listed in SKILL.md (@antv/infographic, opentype.js, sharp) are appropriate for rendering and rasterizing infographics.
Instruction Scope
SKILL.md confines output to the AntV Infographic DSL and gives a strict generation workflow — appropriate for this skill. The two scripts read files from the current working directory and write outputs (input.ifgc/input.svg → output.svg/output.png). This means running the skill will cause file reads/writes relative to the agent's working directory; no instructions request unrelated system credentials or external network calls. Note: the DSL is rendered by a library (@antv/infographic/ssr) which interprets the DSL; that is expected for this use case but could be a place to review if you are concerned about malicious template content.
Install Mechanism
There is no automated install spec (instruction-only), which reduces installer risk. The SKILL.md asks to install standard Node dependencies; no download-from-URL, no obscure package hosts, and no install-time scripts were included in the registry metadata. The required packages are proportionate to the task.
Credentials
The skill declares no required environment variables, no primary credential, and no special config paths. The code reads local files only (templates, a bundled font file) and does not attempt to access environment secrets or network endpoints.
Persistence & Privilege
The skill is not always-enabled and has default agent-invocation settings. It does not request permanent elevated privileges or modify other skills or global agent configuration. The scripts operate only within the working directory.
Assessment
This skill appears internally consistent for generating infographics: it includes many template files and two Node scripts to render the custom DSL to SVG and convert to PNG. Before installing/using it, consider: 1) it requires you to run Node (or bun) and install @antv/infographic, opentype.js, and sharp — install in a controlled environment or sandbox; 2) the scripts read and write files in the agent's current working directory, so avoid running them where sensitive files exist; 3) the bundled font file is named with a .txt extension (likely an embedded binary) — verify the font is legitimate if that matters to you; 4) if you allow the agent to run this autonomously, it will execute file conversion commands locally (no network exfiltration was observed). If you need higher assurance, review the full SKILL.md workflow and run the scripts in an isolated container before granting broader access.Like a lobster shell, security has layers — review code before you run it.
latestvk974dsw35h8hp7vfyjfsprj6xx83r3x9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.