by text2future
Notes for you, Memory for your agents. / 内置 Deepseek harness Agent / 适用 办公 & 写作 & Coding
# Add to your Claude Code skills
git clone https://github.com/text2future/flowixLast scanned: 8/15/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
"severity": "low"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild allows arbitrary file read when running the development server on Windows",
"severity": "low"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to host confusion via literal backslash authority delimiter",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
"severity": "high"
},
{
"type": "npm-audit",
"message": "js-yaml: js-yaml: YAML merge-key chains can force quadratic CPU consumption",
"severity": "high"
},
{
"type": "npm-audit",
"message": "mermaid: Mermaid configuration APIs allow prototype pollution",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "nanoid: nanoid: non-secure generators can loop indefinitely with negative size",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: undici vulnerable to downstream response desynchronization via retry interceptor",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-08-15T04:29:51.283Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how flowix compares with popular alternatives.
flowix is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by text2future. Notes for you, Memory for your agents. / 内置 Deepseek harness Agent / 适用 办公 & 写作 & Coding. It has 409 GitHub stars.
flowix returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/text2future/flowix" and add it to your Claude Code skills directory (see the Installation section above).
flowix is primarily written in TypeScript. It is open-source under text2future on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh flowix against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Write in Markdown, point an agent to the context it needs, and save the result back to the same note — ready to review, edit, and reuse next time.
Keep product work, development, research, and personal knowledge together, so agents can continue without starting over.
| Use case | What it does |
|---|---|
| Product work | Keep requirements, feedback, decisions, and PRDs up to date. |
| Software development | Give coding agents the context to continue your project. |
| Research | Keep sources, analysis, and conclusions together and reusable. |
| Personal knowledge | Turn notes, plans, and preferences into useful agent context. |
Use agents inside Flowix or connect Codex, Claude Code, OpenCode, Hermes, and other MCP or CLI tools — all working from the same notes and context.
dsh-flowix-memory is a DeepSeek Harness plugin that connects any Harness agent to your local Flowix notes through the bundled flowix-cli MCP server: the agent gets the mcp__flowix__memo tool to search, read, create, and edit Flowix memos (including mind maps).
Install it into the flowix Harness profile from the flowix-main checkout (not yet published to npm). In other DSH clients, flowix is an ordinary custom profile name:
dsh plugin --profile flowix add ./dsh-flowix-memory
Requires the flowix CLI on PATH (or set FLOWIX_CLI_PATH) with access to your notebook data (~/.flowix). See the plugin README for details.
Use a UTF-8 file as the recommended way to pass Markdown content to create and write, especially from Windows PowerShell 5.1. This avoids text being damaged by stdin pipeline encoding. UTF-8 files may include a BOM, and files without a BOM are supported too.
flowix create <notebook> --file body.md --json
flowix write <id> --file body.md --json
On Windows, stdin is no longer read implicitly when neither input option is given, preventing PowerShell 5.1's $OutputEncoding from corrupting non-ASCII text. If the caller has guaranteed UTF-8 stdin, opt in explicitly:
$OutputEncoding = [System.Text.UTF8Encoding]::new($false)
Get-Content -Raw -Encoding UTF8 body.md | flowix create <notebook> --stdin --json
--file and --stdin are mutually exclusive. The --file path is read directly as UTF-8; a missing, unreadable, or invalid UTF-8 file returns an error. With --json, errors use the stable {ok:false,error:{code,message}} shape.
Flowix keeps your work as plain Markdown files on your device. You choose what agents can access, when context is sent, and how your files are synced, backed up, or versioned.
| Note library with tags | Note detail with agent presets |
| Agent model picker | Full-text and file search |
| Provider and MCP configuration | Code file browsing and editing |
git clone https://github.com/text2future/flowix.git
cd flowix
npm install
npm run tauri dev
npm run dev
npm run tauri build
The development environment requires Node.js 20+, Rust 1.75+ and Tauri v2; the desktop app supports macOS 14+ and Windows 10+.
Flowix is open source under the MIT License.