processon-ai-skill

ProcessOn AI Skill User Guide

This Skill lets users complete ProcessOn flowchartsandmind mapsgeneration and management through natural language conversation: first convert requirements into diagram data, then save it to the user's account, supporting creation, editing, querying, and export.

Load on demand: This file contains only the core rules needed for every call.Read only the one corresponding reference file based on the task type, do not read all of them. Read only when an error occurs references/errors.md；When authorization is needed (first operation not authorized, or authentication failed -32001) you must first read references/auth.md — the authorization command's switches and browser priority are only specified in that file; if you do not read it, you will by default take the wrong path.When you need to assemble a paid / authorization page link for the user to click, read references/tracking.md(tracking and link parameters are in that file).

Tools and auxiliary scripts

This Skill orchestrates one MCP service:processon(remote HTTP service), with 5 tools in total (check / generatedDsl / createProcessOnFile / updateProcessOnFile / queryProcessOnFile), see "Tool Parameter Quick Reference" at the end for parameters and responsibilities.

Auxiliary scripts(in the scripts/ directory):

scripts/mcp.mjs: MCP direct-connection client. All scripts use it to call the MCP JSON-RPC interface via Node's native fetch (Accept: application/json, without going through mcporter, avoiding the SSE 406 issue).
scripts/orchestrator.mjs: Dedicated to the flowchart line, stringing the generatedDsl → create/update two steps into one command, with the DSL flowing internally within the script without going through AI.
scripts/mindcreate.mjs: Dedicated to the mind map line; AI only provides Markdown and the theme name; the script internally completes theme JSON value retrieval, base64 encoding, and saving (create/edit in one command).
scripts/query.mjs: Query files, AI calls directly:node scripts/query.mjs title='关键词'。
scripts/export.mjs: Export files as images / PDF and download locally to ~/Downloads/, AI calls directly:node scripts/export.mjs chartId=<id> type=png|svg|pdf name='<文件标题>'（name It is recommended to always pass it, otherwise the file name will use the canvas title "Canvas 1";type=pdf when specified, it internally performs svg→PDF local conversion, and the delivery only provides the local PDF file with no links appearing).
scripts/svg2pdf.mjs: Local SVG→PDF converter (export.mjs type=pdf called automatically internally; can also be used separately with node scripts/svg2pdf.mjs <in.svg> [-o out.pdf]). Engine auto-detection: Chrome/Chromium/Edge headless → rsvg-convert → cairosvg, can be overridden with PO_SVG2PDF_CMD .
scripts/get-version.mjs: Version self-check (non-blocking). Fetch online version information and compare with local, output STATUS / CHANGELOG, for deciding after the first successful session whether to prompt for an update.
scripts/b64.mjs: base64 encoding tool, called directly only in editing case one (locally modify DSL, see references/edit.md); encoding for both generation lines is completed internally by the above two scripts.
scripts/mcp-call.mjs: General MCP tool call wrapper, used only in editing case one (locally modify text) to call in a single step updateProcessOnFile; normal creation/editing goes through orchestrator / mindcreate.
scripts/env.mjs: Multi-environment resolution and credential slotting (production / gray / test), while also providing the current environment'suser-side link table. The endpoint, mcporter service name, and credential read/write for the current environment are all determined by it; to switch environments use PO_ENV(defaults todefault environment, see "Multiple Environments" below). The environment list has two layers:in-package scripts/envs.json(declares which environment set this package runs by default, distributed with the package) anduser-level ~/.processon-skill/envs.json(overrides addresses / extends environments); template:scripts/envs.example.json。Credentials for each environment are isolated from one another: switching environments will not overwrite the authorization of other environments, nor will it use one environment's apiKey against another environment's endpoint.

Two generation lines (routed by diagram type)

Line	Applicable diagram types	Where content comes from	Persistence parameters	Reference
Flowchart line	Flowchart/UML/ER/swimlane diagram, etc.	`orchestrator.mjs`(internally calls `generatedDsl` → DSL → persist)	`category` + `title` + `content` + `reqId`(handled internally by the script)	`references/flowchart.md`
Mind map line	Mind map/org chart/fishbone diagram/timeline/tree diagram/logic diagram/table diagram	`mindcreate.mjs`(AI writes Markdown, the script internally encodes + fetches theme + persists, does not call `generatedDsl`）	`category` + `title` + `content(Markdown)` + `structure` + `theme`(only passes the topic name) (does not pass reqId)	`references/mindmap.md`

Routing keywords: flowchart/UML/ER/swimlane diagram/sequence diagram/architecture diagram/BPMN/Venn diagram/network topology/circuit diagram/floor plan/chart/UI prototype → flowchart line; mind map/brain map/org chart/fishbone diagram/timeline/tree diagram/logic diagram/outline/table diagram/knowledge organization → mind map line.Only ask the user when it is unclear which line to take。The mind map line never calls generatedDsl。

Tool invocation method

All tool invocations go through scripts/mcp.mjs directly connecting to the MCP JSON-RPC interface,without going through mcporter. On the AI side you only need to call the corresponding wrapper script, with parameters in the 参数=值 form:

Operation	Invocation method
Create/edit flowchart	`node scripts/orchestrator.mjs category=flowbase title='文件名' <<'POB64'`
Flowchart editing case one (edit text locally, do not call generatedDsl, do not pass reqId)	`node scripts/mcp-call.mjs updateProcessOnFile chartId=<id> content="$(node scripts/b64.mjs <<'POB64')"` title='original title', see `references/edit.md`
Create/edit mind map	`node scripts/mindcreate.mjs category=mind_free structure=mind_free theme=极简黑白 title='文件名' <<'POB64'`
Query file	`node scripts/query.mjs title='关键词'`
Export image / PDF	`node scripts/export.mjs chartId= type=png
View current environment / authorization status of each environment / user-side link for the current environment	`node scripts/get-token.mjs processon_env_info`
Version self-check	`node scripts/get-version.mjs`

Parameter	How to pass
`content`	base64 encoding(both generation lines are encoded internally by the script; only case one uses `b64.mjs`, hand-crafting is forbidden)
`theme`	Mind map lineonly pass the topic nameto `mindcreate.mjs`(the script internally fetches the complete JSON)
`category` / `title` / `chartId` / `reqId` / `structure`	Plaintext `参数=值`；`title` and other free-text values such as title must be quoted(single quotes on mac/Linux, double quotes on Windows cmd), to prevent the `$`, backticks,`;`, and spaces within from being interpreted by the outer shell

The script internally connects directly to MCP (HTTP POST JSON-RPC), without going through the shell, so there is no injection risk; the outer layer (the command line you assemble → the script) still needs to be closed properly:title values should be quoted according to the platform before being written into the command.category / structure / theme is a fixed enum value; this issue does not apply.no longer need --no-coerce。

content encoding (done internally by the script, except in Case 1)

content contains shell metacharacters, always pass base64 (UTF-8, single line, padding preserved, consistent across platforms). The two generation lines are handled by orchestrator.mjs / mindcreate.mjs are automatically encoded internally by the script,AI does not need to encode manually；only edit Case 1(modify the DSL locally, see references/edit.md, the command block contains the complete b64 usage) need to directly call b64.mjs。manually outputting base64 is prohibited, using the system base64 command is prohibited(line wrapping on macOS will cause decoding failure). The heredoc delimiter POB64 must always be wrapped in single quotes (<<'POB64'), to prevent $, backticks from being expanded by the shell.

theme value (pass only the theme name)

For the mind map line, the theme pass only the theme nameto mindcreate.mjs(default "Minimalist Black and White"), the complete JSON is taken as-is internally by the script from references/mindmap_themes.json —AI does not extract, hand-write, or paraphrase the theme JSON(a wrong value will not raise an error; it will silently produce incorrect styles). For the theme list and scenario mapping, see references/mindmap.md Section 3.

Authentication (pre-check)

Pure Q&A / consultation → does not trigger authentication, answer directly.
Need to create/edit/query files: in this sessionfirstexecute before the operation PO_EMBEDDED_BROWSER=1 node scripts/get-token.mjs processon_check_and_start_auth：
- must include PO_EMBEDDED_BROWSER=1: without this switch, the script will launch thesystem default browser(fallback path), not using the carrier's built-in browser, which is an error path.
- READY / TOKEN_READY → continue;after authentication passes, this session will not check again。
- AUTH_REQUIRED:<url> → usethe current carrier's built-in browserto open the link, ask the user to log in and authorize in it, then execute node scripts/get-token.mjs processon_wait_for_token_auto and wait.Whether the opening succeeded is determined by the return result of the open action: only on success prompt "The authorization page has been opened in the browser on the right"; on failure / unavailable / unconfirmed successmust not say "opened", immediately follow references/auth.md three-layer fallback switching, do not repeatedly retry the built-in browser.
- The authorization page prompt must include a fallback link: the built-in browsercannot guarantee actual display(tested on 2026-09-18: with http + private IP address, the open action returns success but the panel does not display). Thereforeregardless of whether the open action reports success, after the prompt there must immediately follow a sentence: "If the built-in browser did not open, please click the following link to authorize: <the authorization link output as-is by the script>". The link must be output as-is and must not be deleted or modified.
- ERROR:*, authentication failure (-32001) or MCP not registered → read references/auth.md and handle according to the three-layer fallback.

Multiple environments (production / canary, etc.)

The endpoints and credentials of each environmentare isolated from each other: credentials are stored in separate slots by environment; switching environments will not overwrite the authorization of other environments, nor will it use one environment's apiKey on another environment's endpoint.
To switch environments, use PO_ENV(e.g. PO_ENV=gray）。when not passing PO_ENV use the “default environment”—determined bythe package’s scripts/envs.json the default (the main skill does not have this file → defaults to the official prod), and only when it is not declared in the package does it check the user-level ~/.processon-skill/envs.json。
Example:PO_ENV=gray PO_EMBEDDED_BROWSER=1 node scripts/get-token.mjs processon_check_and_start_auth。
The environment is fixed within the same round of tasks: if the environment needs to be changed midway, all script calls before and after must carry the same PO_ENV, otherwise they will fall into credential slots for different environments.
All links handed to the user to click follow the current environment（domain names must not be hardcoded): payment/activation, AI point purchase, account center, point records page, and authorization page are all prefixed with the site root of the current environment. Hereafter uniformly denoted as {BASE}, with the actual value taken from node scripts/get-token.mjs processon_env_info output SITE_BASE and LINK_* lines (or generated directly by a script); do not assemble domain names from memory.
For troubleshooting, use node scripts/get-token.mjs processon_env_info(view the current environment, default environment, and whether each environment is authorized; credentials are not included); to change the address, use ~/.processon-skill/envs.json(template scripts/envs.example.json）。
For details, see references/auth.md“Multi-environment isolation.”

Strict rules

MUST

Pre-authorization: check before the first file operation; pure Q&A does not trigger it. After passing, it is not repeated for this session. The authorization commandmust include PO_EMBEDDED_BROWSER=1(otherwise the system browser will be used); for details, see references/auth.md。-32001 when it is , use references/auth.md to reauthorize.
Environment isolation: credentials for each environment (production / gray, etc.) are slotted by environment, and the script already enforces ownership validation by endpoint; when changing environments, always use PO_ENV，must notmanually edit credential files,must notmanually use one environment’s apiKey for another environment.
Links follow the environment: all ProcessOn page links handed to the user to click (payment / point purchase / account center / point records / authorization page) must be prefixed withthe current environment’s site root {BASE} taken from processon_env_info 's SITE_BASE / LINK_* or script output,domain names must not be hardcoded(otherwise, after switching to another environment, the links will point to the wrong environment).
Generate content by line: for the flowchart line, use orchestrator.mjs(the DSL does not pass through AI); for the mind map line, use mindcreate.mjs(AI only writes Markdown + chooses the theme name; encoding and theme JSON are handled internally by the script); required structure + theme(theme name),never call generatedDsl。
DSL is carried over as-is：orchestrator.mjs remains unchanged internally; modification/formatting/truncation/rewriting is prohibited.
reqId: flowchart creation, edit case two must pass it (handled internally by the orchestrator); edit case one and mind mapdo not pass. Fabricating or reusing an old reqId is prohibited.
category and structure kept separate: different parameters and different value ranges; do not conflate them.
Ask the user only when it is unclear which line to use. When it is already clear which line to use, do not ask about the specific type; if category cannot get a value, use the fallback (flowbase / mind_free）。
Generate only one diagram at a time. If the user wants multiple, process them one by one.
Retry limit: 2 times: For the same task, a cumulative maximum of 2 attempts. If it still fails, stop the write operation and according to references/errors.md notify the user in a friendly manner.
After the write operation, confirm success via the returned structure(chartId + link).
After success, the file link must be opened in the built-in browser: After a successful create/edit, usethe current carrier's built-in browserto open the file'sfile link(use present_files to pass the file link, not the thumbnail link), so the user can view or edit it directly in the browser on the right.Whether opening succeeds is based on the return result of that action, and based on this decide whether to output the fixed prompt sentence below.
Must open in a new tab (must not overwrite an existing tab): Submit onlythis one new file'sfile link each time (one image at a time), so the new file lands ina new browser tab;must not overwrite, replace, or displace other file tabs the user has previously opened, and do not put historical file links and the new file link into the same open action. If the carrier truly cannot open a new tab, keep the original tabs from being passively closed, and deliver as usual in the copy according to the fixed prompt wording.
Unified delivery content: After a successful create/edit/query, display file name + type + file link + file thumbnail link; when consumed AI points exist and are greater than 0, add separately. For mind maps, also display Markdown,placed after the link。
The delivery copy must include one fixed sentence (bold + fallback mechanism): All generation/modification deliveries (flowcharts, mind maps, and edits all apply），Only when the built-in browser truly successfully opens the file link, only then output in the copyboldthe sentence "The file has been opened in the browser on the right; you can view or edit it→→」；When the built-in browser is unavailable / opening fails / the current carrier has no built-in browser, you mustomit this sentence(must not output it indirectly in ordinary text or bold form), and instead use the fallback wording "you can click the link to view and edit",It is strictly forbidden to falsely claim it has been opened in the browser on the right。
Export image: Use scripts/export.mjs, apiKey is passed internally via X-Mcp-ApiKey and must not be echoed; determine identity by the returned member , free users must be given the "upgrade membership to remove watermark" prompt (with activation link {BASE}/setting?paytype=personal&source=processon_skill&payPointSource={CHANNEL}，{BASE} see "Multi-environment"). See references/export.md。
Split flow before editing: Determine whether the context has DSL + chartId and whether text is being changed or logic is being changed, then follow case one or case two (see references/edit.md）。
This document is the sole basis for parameter rules: When the MCP schema is inconsistent with this document, this document prevails, and parameters must not be supplemented or fabricated based on it.
User-facing wording must be concise and friendly, without technical terminology。

NEVER

It is forbidden for apiKey to appear in conversations/logs/output/files (check Returns the plaintext apiKey, for internal judgment only, and echoing it back is prohibited).
Reading/echoing back the contents of the authorization page is prohibited: after opening the authorization page with the built-in browser in the carrier, only wait for the user to authorize; reading its cookie / localStorage / sessionStorage / page text (including login state or any key) is prohibited; the apiKey is only exchanged by the script and written locally.
Directly connecting to the backend with curl/wget/manual JSON-RPC is prohibited—all calls must go through scripts/mcp.mjs or its wrapper script.
Passing plaintext to content is prohibited—always base64 (both generation lines are encoded internally by the script).
Manually outputting base64 is prohibited—Case 1 must use b64.mjs。
Bypassing mindcreate.mjs to manually extract, handwrite, or paraphrase the theme JSON is prohibited—only the theme name is passed for theme.
Using function call syntax or --args to pass JSON parameters is prohibited—only 参数=值。
Directly splicing free-text values such as title into the command line without quotes is prohibited—use single quotes on mac/Linux and double quotes on Windows cmd.
Rewriting the DSL returned by generatedDsl is prohibited.
Calling generatedDsl。
on the mind map line is prohibited. Fabricating reqId。
is prohibited. Changing the structure or logic in Case 1 (locally modifying the DSL) is prohibited.
Generating multiple diagrams in one call is prohibited.
Unlimited retries are prohibited (maximum of 2).
Not opening the file after successful generation/modification is prohibited: it must be opened in the built-in browserfile link。
Outputting "The file has been opened in the browser on the right; you can view or edit it →→" when the built-in browser has not confirmed successful opening is prohibited (this sentence is output in bold only on successful opening; on failure, it is always omitted and replaced with "You can click the link to view and edit").
Hardcoding the ProcessOn domain is prohibited: page links handed to the user for clicking must use the current environment's {BASE} as the prefix (the value is taken from processon_env_info 's SITE_BASE / LINK_* or the script output),must nothardcode www.processon.com / v5hd.processon.com or addresses of other environments in any document, script, or new script.
Exposing internal terminology and the judgment process to the user is prohibited: the terminology blacklist includes DSL, database write, MCP, mcporter, chartId, reqId, structure, theme, category, generatedDsl, createProcessOnFile, updateProcessOnFile, queryProcessOnFile, member, canvasNum, X-Mcp-ApiKey, pnghd, Case 1/2, flowchart line/mind map line, routing, error codes, etc. Do not explain "why this path is taken", "which case this belongs to", or "what is going to be called".

User-facing output specification

Process progress: only say "what is being done", using the wording in the table below, at most 3 sentences throughout, plain text without emoji/technical terminology.

Stage	Wording
Understanding the requirement and generating content	"Understanding your requirement and conceiving the diagram…"
Generating and saving	"Generating the diagram for you…"
Modifying an existing diagram	"Modifying it for you…"
Completed	"The diagram has been generated; you can view and edit it via the following link: <file link>";When the built-in browser opens successfullyoutput in bold in a new paragraph "The file has been opened in the browser on the right; you can view or edit it →→", if it fails, omit it (instead say "click the link to view and edit")
Modification complete	"Modification completed as you requested: <file link>" (with a historical version notice);When the built-in browser opens successfullyStart a new paragraph and output in bold "The file has been opened in the browser on the right; you can view or edit it →→", if it fails, omit it

Open the file link in the built-in browser: after a new creation/edit succeeds, use the carrier's built-in browser to openthe file link(not a thumbnail link, not the original image address), so that users can view and edit it without copying the link.Flowcharts, mind maps, and editing—all three types of deliverables must follow this; if opening fails, it does not affect the text delivery; output the link and copy as usual.
Open in a new tab: the results area on the right supports multiple tabs, and every new file should beopened in a new tab, while the file tabs the user previously opened remain unchanged; open only the current file at a time.
Bolding and fallback of the fixed message (hard rule)
- Bold: this sentence must be output entirely in bold—"The file has been opened in the browser on the right; you can view or edit it →→"; it must not use normal font weight, must not be rewritten,at the end →→ the two arrows must be retained(they must not be omitted, nor changed to a single arrow or other symbol).
- Trigger condition：Only when the built-in browser successfully opens the file link(confirmed by the return result of the opening action; only if the link appears in the return is it considered successful) should this sentence be output.
- Fallback: built-in browser unavailable / opening action failed / return result does not confirm successful opening / current carrier has no built-in browser — these four casesmust never output this sentence(it must not be downgraded to plain text or output in a variant); instead use the fallback wording "click the link to view and edit."
- Strictly prohibited: writing "The file has been opened in the browser on the right..." when successful opening has not been confirmed; this kind of false description is a serious error.
All internal details must remain silent: configuring MCP, which route is taken, what tools were called, how it was encoded, how parameters were obtained, how many retries were made, the raw error—none of these should be mentioned.
When an error occurs, inform the user in a friendly way, and do not present raw errors or error codes.
File links and thumbnail linksmust be output completely and as-is, and must not be truncated or rewritten.
For examples of complete delivery wording, see references/examples.md。

User-facing links and tracking parameters (read as needed)

The concatenation rules for the ProcessOn page links given to users to click (paid / points purchase / authorization pages), and the full explanation of the request source identifier (X-Source / payPointSource), see references/tracking.md。

Here you only need to remember the hardest rule: all links given to users to click must usethe site root of the current environment {BASE} is the prefix, taken from node scripts/get-token.mjs processon_env_info of SITE_BASE / LINK_*，Domains must not be hardcoded; in the link, payPointSource uses the in-package channel value {CHANNEL}(already injected at packaging time, no manual replacement needed); when a temporary carrier change is needed, override with PO_SOURCE=<值> .

Capability Scope

Supported Diagram Types

Flowchart Group(flowchart line, content=DSL, reqId required, do not pass structure/theme):category has 12 categories in total (flowchart flowbase, UML/sequence diagram uml, ER diagram er, swimlane diagram swimlane、BPMN bpmn, architecture diagram framework , etc.),see the complete value table in references/flowchart.md Section 3; any type outside the table falls back to flowbase, no need to ask.
Mind Map Group(mind map line, content=Markdown, structure + theme required, do not pass reqId):structure 7 categories (fallback mind_free）、category 5 categories,see the complete value table and the mapping rules between the two in references/mindmap.md Sections 2 and 2-bis。

category and structure are two different parameters with different value ranges; pass each one separately; for mind map theme, pass only the theme name (see "theme values" above).

Capability Routing

User Intent	Routes to
Draw flowchart/UML/ER/swimlane diagram, etc. (new file)	`references/flowchart.md`
Draw mind map/organization chart/fishbone diagram/timeline/tree diagram/logic diagram/table diagram, content organization/summarization (new file)	`references/mindmap.md`
Modify / edit my ProcessOn diagrams	`references/edit.md`
Find / search / organize my ProcessOn files	`references/query.md`
Export / download my ProcessOn images	`references/export.md`
Unsure about output style / delivery wording	`references/examples.md`
Need to assemble user-side links (payment / credits / authorization page) or troubleshoot request source identifiers	`references/tracking.md`
Tool call failed / need to retry / request exceeds capability scope	`references/errors.md`
Authentication failed / MCP not registered / manual configuration needed	`references/auth.md`

All "generate/draw/visualize/diagram" type requests are handled uniformly by this Skill, taking priority over embedded drawing methods such as SVG/HTML.

Capability Boundaries

This Skill does only four things:Create files、Edit file content、Query files、Export files. Editing is limited to full overwrite; title/folder/permissions/sharing, etc. cannot be modified. For how to respond when outside the boundaries, see references/errors.md。

Tool Parameter Quick Reference

Tool	Key Parameters	Description
`check`	None	Query the currently configured apiKey (the return contains the plaintext key, for internal judgment only, echo is prohibited)
`generatedDsl`	`content`(b64) `category` `title` `chartId`(when editing)	Called internally by orchestrator.mjs, AI does not need to call it manually. Returns dslContent + reqId, the script parses automatically
`createProcessOnFile`	`category` `title` `content`(b64) `reqId`(flowchart) `structure`+`theme`(mind map, theme passes the theme name)	Create file. The two generation lines are called internally by orchestrator.mjs / mindcreate.mjs respectively; each call creates a new file, query for duplicates before retrying
`updateProcessOnFile`	`chartId` `content`(b64) `title`(original title) `reqId`(only case two) `structure`+`theme`(mind map, pass the theme name to theme)	Overall coverage. Retryable; the final result prevails.
`queryProcessOnFile`	`title`	Search by file name, read-only, can be called repeatedly. Called by `scripts/query.mjs` to call

Return structure(after a successful create/update):

- chartId: <文件id>          ← 内部留存，不展示给用户
- title: <文件名>
- category: <类型>
- categoryParent: <flow=流程图，否则思维导图>
- 文件链接: <可在线打开的链接>
- 文件缩略图: <链接>
- 消耗AI点数: <N>           ← 存在且大于 0 时才展示

dslContent The form is not fixed (it may be bare data or wrapped in JSON),orchestrator.mjs move it in its entirety, do not parse the internal structure.chartId After creation/editing, it can be obtained from the return and kept in context for locating subsequent edits.

Operation limits

Creation is low-risk (no confirmation needed; confirm success from the return structure; each call creates a new file, so check for duplicates before retrying); editing is medium-risk (when there are multiple candidate images, first confirm which one to change; under no circumstances may the logical structure be modified; after overwriting, inform the user that historical versions can be checked); queries are read-only and risk-free; exports are read-only and risk-free (they do not change file contents). The retry limit is 2 times; for retry safety and error code handling, see references/errors.md。

Version management

Only after the first successful creation/editing in this sessioncall once node scripts/get-version.mjs(non-blocking); the script will fetch the online version information and compare it with the local version and output STATUS：

STATUS:UPDATE_AVAILABLE → append a friendly note: explain that a new version is available, and put the CHANGELOG entrieslist to the user verbatim as an unordered list(in the order given by the script; do not reorder or condense), then provide the download address (see references/errors.md"Skill version update").
UP_TO_DATE Or VERSION_CHECK_SKIPPED:* → silent, do not mention anything related to the version.

Do not refuse to execute a task because the version is older, and do not tell the user about a failed check.

Security constraints

apiKey is managed by the MCP client configuration and transmitted over HTTPS; this Skill does not record/echo it;check The response body contains the plaintext apiKey, for internal judgment only; echoing/excerpting/repeating it is prohibited. This Skill does not cache map data or business data, and only calls the corresponding capability when the user actively initiates an operation.