excalidraw-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts/ensure_mcp.py script executes the claude mcp add command to register the Excalidraw MCP server. This is a documented setup step using the official platform CLI.
- [EXTERNAL_DOWNLOADS]: The scripts/excalidraw_render.py utility fetches the Excalidraw library from esm.sh, which is a well-known and trusted service for serving NPM packages.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied JSON data to generate diagrams. While this represents a data ingestion surface, the processing is performed through structured JSON parsing and drawing-specific logic, minimizing risk.
- [DATA_EXPOSURE]: The setup script reads local Claude configuration files to check for existing server registrations, which is the intended and necessary behavior for environment preparation.
Audit Metadata