excalidraw

Pass

Audited by Gen Agent Trust Hub on Mar 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Node.js script (render.mjs) to process diagram data and generate visual outputs. This execution is limited to the skill's own logic and the local environment.
  • [EXTERNAL_DOWNLOADS]: The skill requires standard packages from the NPM registry, including roughjs, @resvg/resvg-js, and @xmldom/xmldom. These are well-known, legitimate libraries used for SVG rendering and image conversion.
  • [DATA_EXPOSURE]: Diagrams are saved to a user-configurable local directory, and temporary data is stored in /tmp during the rendering process. This is a common and acceptable pattern for local file-based tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 21, 2026, 07:04 AM
Security Audit — agent-trust-hub — excalidraw