FlowMind
v1.0.2Manage productivity with FlowMind — goals, tasks (with subtasks), notes, people, and tags via REST API. Use when the user wants to create, list, update, or delete goals, tasks, notes, contacts, or tags; manage focus/priorities; track progress; or organize their productivity workspace through FlowMind.
⭐ 3· 3.8k·15 current·16 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (FlowMind REST API for goals, tasks, notes, people, tags) matches the SKILL.md endpoints and reference doc — the claimed capability is coherent with the provided API surface. However the registry metadata claims no required environment variables while the SKILL.md explicitly instructs the agent to set FLOWMIND_API_KEY, which is inconsistent.
Instruction Scope
SKILL.md only describes constructing HTTP requests to the FlowMind API (Authorization: Bearer <FLOWMIND_API_KEY>, Content-Type: application/json) and standard endpoints; it does not instruct the agent to read unrelated files, enumerate system config, or exfiltrate data to unexpected endpoints.
Install Mechanism
This is an instruction-only skill with no install spec and no bundled code — lowest install risk. There are no downloads or extracted artifacts in the manifest.
Credentials
SKILL.md requires FLOWMIND_API_KEY (Bearer token) but the registry metadata lists no required environment variables or primary credential. Asking for an API key is reasonable for this API integration, but the metadata omission is an incoherence that should be resolved before trusting the skill.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide configuration changes. Default autonomous invocation is allowed (platform default) but is not combined with other privilege escalations.
What to consider before installing
This skill appears to implement a straightforward REST integration for FlowMind, but there are two things you should verify before installing: (1) metadata mismatch — SKILL.md requires FLOWMIND_API_KEY but the registry metadata lists no required credentials; ask the publisher or registry to update the declared required env var so you know what the skill will use. (2) origin and trust — the skill's source is unknown and there is no homepage; confirm the author and prefer skills with verifiable source. If you proceed, only provide a FlowMind API key with limited scope (if possible), avoid using high-privilege or long-lived account credentials, and consider restricting the agent's autonomous invocation or monitoring network requests until you are satisfied. If the registry is updated to explicitly declare FLOWMIND_API_KEY and the publisher/source is verifiable, this assessment would likely move to benign.Like a lobster shell, security has layers — review code before you run it.
latestvk9707dcyq9148hc57gwez544018085z0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.