excalidraw-it
Warn
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses
scripts/modules.pyto dynamically discover and load Python modules from thechecks/andpieces/subdirectories viaimportlib.util. This implementation supports a plugin architecture but involves executing code from file paths determined at runtime. - [REMOTE_CODE_EXECUTION]: The
scripts/mermaid.pyscript executes a Node.js utility (convert.mjs) which uses Playwright to dynamically import and evaluate JavaScript fromhttps://esm.sh/. This process involves executing remote code within a headless browser to perform diagram element conversions. - [EXTERNAL_DOWNLOADS]: The skill performs automated package management during setup.
scripts/fonts.pyusesnpm packto retrieve font metrics from the@excalidraw/excalidrawpackage, andscripts/mermaid.pyexecutesnpm installfor conversion dependencies. These downloads are directed to the official npm registry. - [COMMAND_EXECUTION]: Several components, including
fonts.pyandmermaid.py, utilize thesubprocessmodule to execute system commands such asnpmandnode. These are used for dependency installation and for running the external Mermaid conversion process.
Audit Metadata