excalidraw

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No security vulnerabilities were detected. The skill is instructional and focuses on improving agent efficiency through subagent delegation when handling verbose Excalidraw JSON files.\n- [PROMPT_INJECTION]: The skill defines a pattern for processing untrusted external data (Excalidraw files) that could theoretically contain malicious instructions within text elements. However, the skill's core design—delegating these tasks to isolated subagents—serves as a natural boundary and mitigation strategy.\n
  • Ingestion points: SKILL.md and README.md (processing of *.excalidraw and *.excalidraw.json files).\n
  • Boundary markers: The subagent delegation pattern itself acts as a context boundary, although no specific text-delimiting instructions are provided in the templates.\n
  • Capability inventory: Subagents are instructed to read, summarize, and write diagram files.\n
  • Sanitization: The skill focuses on extraction and summarization of text elements without explicit sanitization logic.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 09:11 AM
Security Audit — agent-trust-hub — excalidraw