excalidraw-it

Warn

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses scripts/modules.py to dynamically discover and load Python modules from the checks/ and pieces/ subdirectories via importlib.util. This implementation supports a plugin architecture but involves executing code from file paths determined at runtime.
  • [REMOTE_CODE_EXECUTION]: The scripts/mermaid.py script executes a Node.js utility (convert.mjs) which uses Playwright to dynamically import and evaluate JavaScript from https://esm.sh/. This process involves executing remote code within a headless browser to perform diagram element conversions.
  • [EXTERNAL_DOWNLOADS]: The skill performs automated package management during setup. scripts/fonts.py uses npm pack to retrieve font metrics from the @excalidraw/excalidraw package, and scripts/mermaid.py executes npm install for conversion dependencies. These downloads are directed to the official npm registry.
  • [COMMAND_EXECUTION]: Several components, including fonts.py and mermaid.py, utilize the subprocess module to execute system commands such as npm and node. These are used for dependency installation and for running the external Mermaid conversion process.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 30, 2026, 11:29 AM