tldraw-canvas
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill allows the agent to read and search the content of external
.tldrfiles, which could contain malicious instructions designed to influence the agent's behavior. - Ingestion points: Content is ingested through the
tldraw_read,tldraw_search, andtldraw_get_shapestools as described inSKILL.md. - Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands within the processed file data.
- Capability inventory: The skill has the capability to write to the file system and modify files using
tldraw_create,tldraw_write, andtldraw_update_shapetools. - Sanitization: No sanitization or validation procedures are mentioned for the text content retrieved from the canvas elements.
- [EXTERNAL_DOWNLOADS]: The skill refers to the
@talhaorak/tldraw-mcpserver as a prerequisite, which is a third-party dependency from an unverified source.
Audit Metadata