tldraw-canvas

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill allows the agent to read and search the content of external .tldr files, which could contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: Content is ingested through the tldraw_read, tldraw_search, and tldraw_get_shapes tools as described in SKILL.md.
  • Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands within the processed file data.
  • Capability inventory: The skill has the capability to write to the file system and modify files using tldraw_create, tldraw_write, and tldraw_update_shape tools.
  • Sanitization: No sanitization or validation procedures are mentioned for the text content retrieved from the canvas elements.
  • [EXTERNAL_DOWNLOADS]: The skill refers to the @talhaorak/tldraw-mcp server as a prerequisite, which is a third-party dependency from an unverified source.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:44 PM