excalidraw
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for programmatic diagram generation and management using a local MCP server (
excalidraw). - [SAFE]: All operations are restricted to local file manipulation (creating and editing
.excalidrawfiles) within the project directory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data when calling
getFullDiagramStateto read existing diagram files. While these files are local, they represent an ingestion surface where embedded instructions could theoretically influence the agent's behavior. However, this is a standard capability for diagramming tools and the risk is minimal given the specialized nature of the data (diagram nodes and edges).
Audit Metadata