tldraw-skill
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several system commands to fulfill its functionality. These include dependency management via
npm install, directory creation usingmkdir -p, and diagram processing using thetldrawCLI. It also utilizes platform-specific commands such asopen(macOS),xdg-open(Linux), andstart(Windows) to allow users to preview generated files. - [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
@kitschpatrol/tldraw-clipackage from the public npm registry to enable diagram exporting capabilities. - [REMOTE_CODE_EXECUTION]: The skill implements a self-maintenance workflow that checks for newer versions using
git ls-remote. If an update is detected, it offers to perform agit pullto update the skill's own instructions and logic. This mechanism is transparent, as it explicitly asks for user permission before modifying the skill directory.
Audit Metadata