Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Felo Mindmap

v1.0.0

Generate mindmaps with Felo Mindmap API in Claude Code. Use when users ask to create/make/generate mindmaps, mind maps, or thinking maps, or when explicit co...

0· 149·1 current·1 all-time
bywangzhiming@wangzhiming1999

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for wangzhiming1999/felo-mindmap.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Felo Mindmap" (wangzhiming1999/felo-mindmap) from ClawHub.
Skill page: https://clawhub.ai/wangzhiming1999/felo-mindmap
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install felo-mindmap

ClawHub CLI

Package manager switcher

npx clawhub@latest install felo-mindmap
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's code and SKILL.md implement mindmap creation via Felo's API (POST to https://openapi.felo.ai/v2/mindmap), which matches the name/description. However, the manifest declares no required environment variables or binaries while the runtime expects FELO_API_KEY (mandatory) and optionally FELO_API_BASE, and a Node runtime (node). Those omissions are inconsistent with the stated purpose and deployment metadata.
Instruction Scope
The SKILL.md keeps to the declared purpose: run a node script that sends the user's prompt and layout to the Felo API and returns mindmap_url. It instructs the agent to run shell/node commands and to read FELO_API_KEY from the environment; it does not request unrelated files or credentials. Note that user prompts are transmitted to a third-party API (Felo).
Install Mechanism
No install spec or external downloads are present; the skill is instruction + a small local node script. This is low install risk (nothing fetched at install time).
!
Credentials
The runtime requires an API key (FELO_API_KEY) and supports FELO_API_BASE, but the registry metadata lists no required env vars or primary credential. The discrepancy means the manifest understates the credential need. FELO_API_KEY grants the skill access to the user's Felo account and will be sent as a Bearer token to the API; this is expected but should be declared in the manifest. Also, the script expects a node binary but the manifest lists none.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and has no install step that persists beyond its files. It only runs when invoked and requires no elevated privileges.
What to consider before installing
This skill appears to perform the advertised task (POST your prompt to Felo and return a mindmap URL) but the package metadata is incomplete. Before installing or providing credentials: (1) verify you are comfortable sending prompts/data to https://openapi.felo.ai (prompts will be transmitted with your FELO_API_KEY in Authorization header); (2) supply FELO_API_KEY only after confirming the skill source (homepage is missing and the registry owner ID is opaque); (3) ensure your agent environment has node available (the script runs with `node ...`) or the script will fail; (4) be aware the code also honors FELO_API_BASE (undocumented in the manifest) — do not set it to an untrusted host; (5) consider testing with non-sensitive prompts and a scoped/test API key first; and (6) ask the publisher to update the manifest to declare FELO_API_KEY and the node requirement (and to publish a homepage/repo) so the capability and requirements are coherent.
scripts/run_mindmap_task.mjs:157
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk973da3t4e5vgfqcy2sbbv3h1x83y8ps
149downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

Felo Mindmap Skill

When to Use

Trigger this skill for requests about creating mindmap files:

  • Create/generate mindmaps from a topic or question
  • Turn ideas into a structured mindmap
  • Build a mindmap with different layout types (timeline, fishbone, etc.)
  • Export mindmap content into a shareable link

Trigger keywords:

  • Chinese prompts about making mindmaps (思维导图, 脑图)
  • English: mindmap, mind map, thinking map, generate mindmap
  • Explicit commands: /felo-mindmap, "use felo mindmap"

Do NOT use this skill for:

  • Real-time information lookup (use felo-search)
  • Questions about local codebase files
  • Pure text tasks that do not require mindmap generation

Setup

1. Get API key

  1. Visit felo.ai
  2. Open Settings -> API Keys
  3. Create and copy your API key

2. Configure environment variable

Linux/macOS:

export FELO_API_KEY="your-api-key-here"

Windows PowerShell:

$env:FELO_API_KEY="your-api-key-here"

How to Execute

Use Bash tool commands and follow this workflow exactly.

Step 1: Precheck API key

if [ -z "$FELO_API_KEY" ]; then
  echo "ERROR: FELO_API_KEY not set"
  exit 1
fi

If key is missing, stop and return setup instructions.

Step 2: Run Node Script

Use the bundled script:

node felo-mindmap/scripts/run_mindmap_task.mjs \
  --query "USER_PROMPT_HERE" \
  --timeout 60

To specify a layout type:

node felo-mindmap/scripts/run_mindmap_task.mjs \
  --query "USER_PROMPT_HERE" \
  --layout "TIMELINE" \
  --timeout 60

Available layout types:

  • MIND_MAP (default) - Classic mind map
  • LOGICAL_STRUCTURE - Logical structure diagram
  • ORGANIZATION_STRUCTURE - Organization chart
  • CATALOG_ORGANIZATION - Catalog organization chart
  • TIMELINE - Timeline diagram
  • FISHBONE - Fishbone diagram

To add mindmap to an existing LiveDoc:

node felo-mindmap/scripts/run_mindmap_task.mjs \
  --query "USER_PROMPT_HERE" \
  --livedoc-short-id "EXISTING_LIVEDOC_ID"

Script behavior:

  • Creates mindmap via POST https://openapi.felo.ai/v2/mindmap
  • Returns immediately (synchronous API, no polling needed)
  • Prints mindmap_url on success

Optional debug output:

node felo-mindmap/scripts/run_mindmap_task.mjs \
  --query "USER_PROMPT_HERE" \
  --json

This outputs structured JSON including:

  • resource_id
  • status
  • mindmap_url
  • livedoc_short_id

Step 3: Return structured result

On success, return:

  • mindmap_url immediately
  • if --json is used, also include resource_id, livedoc_short_id

Output Format

Use this response structure:

## Mindmap Generation Result

- Resource ID: <resource_id>
- Status: <status>
- Mindmap URL: <mindmap_url>
- LiveDoc Short ID: <livedoc_short_id>

Error format:

## Mindmap Generation Failed

- Error Type: <error code or category>
- Message: <readable message>
- Suggested Action: <next step>

Error Handling

Known API error codes:

  • INVALID_API_KEY (401): key invalid or revoked
  • MINDMAP_CREATE_FAILED (502): mindmap creation failed
  • LIVEDOC_CREATE_FAILED (502): failed to create LiveDoc
  • LIVEDOC_NOT_FOUND (404): specified LiveDoc not found
  • LLM_SERVICE_UNAVAILABLE (503): LLM service is unavailable
  • LLM_REQUEST_TIMEOUT (504): LLM request timed out

Important Notes

  • Always execute this skill when user intent is mindmap generation.
  • The API is synchronous - no polling required.
  • Keep API calls minimal: one request per mindmap.

References

Comments

Loading comments...