skills/djalmajr/skills/excalidraw/Gen Agent Trust Hub

excalidraw

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads necessary libraries from the public npm registry.
  • Evidence: scripts/setup.sh executes npm install to fetch @excalidraw/excalidraw, jsdom, and canvas.
  • [COMMAND_EXECUTION]: The skill executes local scripts to process diagram files.
  • Evidence: User instructions involve running node scripts/render.mjs and node scripts/lint-scene.mjs to generate and validate scenes.
  • [PROMPT_INJECTION]: The skill ingests untrusted data that could contain indirect instructions.
  • Ingestion points: Reading element text from .excalidraw JSON files.
  • Capability inventory: The agent uses this data to summarize or reason about diagrams, and the toolchain performs subprocess calls via node for rendering.
  • Boundary markers: None identified for text element content.
  • Sanitization: JSON parsing is performed, but no semantic filtering or escaping of text content is noted for agent interpretation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 12:52 AM
Security Audit — agent-trust-hub — excalidraw