Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
An AI skill for OpenClaw that generates professional diagrams from natural language descriptions using EdrawMax AI APIs.
v1.0.0Generate diagrams from natural language using EdrawMax AI APIs. Supports four diagram types: flowchart (流程图), infographic (信息图), Gantt chart (甘特图), and mind...
⭐ 0· 229·2 current·2 all-time
byEdrawMax-AI@xkweimeng
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description claim: generate diagrams via EdrawMax AI APIs. The SKILL.md, API reference, and included download script all align with that purpose. The skill does not request unrelated credentials or system paths.
Instruction Scope
Instructions are focused: call the specified EdrawMax endpoints, then run the provided Python downloader and present local file paths and source code. It explicitly directs the agent to send user prompts to an external service (api.edrawmax.cn) and to save files locally. This is expected for the stated function, but it implies user content will be transmitted to an external third party — a privacy consideration.
Install Mechanism
No install spec; instruction-only plus a small helper script. Nothing is downloaded or written by an installer. This is low-risk from install mechanics.
Credentials
The skill requests no environment variables, credentials, or config paths. That is proportionate to the published (unauthenticated) API usage. Note: the API docs state 'Auth: None required' and that user_id is extracted from an X-User-ID header server-side — if your agent/platform attaches identifying headers, those will reach the remote API.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request permanent agent-wide privileges or modify other skills' configs.
What to consider before installing
What to consider before installing:
- Privacy: The skill sends your text prompts to api.edrawmax.cn (an external service). If your diagrams contain sensitive data, that data will be transmitted and stored by the remote service. Confirm you are comfortable with that.
- SSL verification disabled: The included downloader script explicitly disables TLS certificate validation (ssl.verify_mode = CERT_NONE). This makes downloads vulnerable to man-in-the-middle tampering. Before running in a real environment, either remove the code that disables verification or run the skill in a trusted, isolated network. Prefer enabling certificate validation.
- Provenance and trust: The package lacks a homepage and the source is 'unknown'. If you need stronger assurance, request official publisher verification (an official EdrawMax homepage, signed release, or corporate publisher record) before trusting the skill in production.
- Local filesystem writes: The script writes files under ./edrawmax_output by default. Ensure the output directory is not a sensitive path and review saved files after use.
- No credentials requested: The API is documented as unauthenticated. If you expected the service to require an API key, verify this behavior with the vendor — unauthenticated endpoints may impose rate limits or accept content you wouldn't want publicly processed.
If you want to proceed: run the skill in a sandboxed environment, inspect/modify the downloader to enable TLS verification, and verify the remote domain (api.edrawmax.cn) is legitimate and acceptable for your data before sending sensitive prompts.
What would change the assessment: availability of an official homepage or publisher verification, removal/fix of the SSL-disable code, or explicit, documented reasons for TLS verification being disabled would reduce concern and could raise confidence to high/benign.Like a lobster shell, security has layers — review code before you run it.
latestvk97337zprwb7adsqmgnj9pttbh82tvyb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
