excalidraw
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads diagramming assets from the official Excalidraw libraries repository on GitHub. This is handled by a local Python script that manages the acquisition of vector primitives to extend the agent's drawing capabilities.
- [COMMAND_EXECUTION]: The skill uses shell commands for environment setup and rendering tasks, including global package installation via npm, browser binary installation via npx, and the use of sed to apply platform-specific keybinding patches to the local rendering engine.
- [DATA_EXFILTRATION]: The skill transmits diagram source data to the Kroki API for remote SVG rendering. This is an intended and documented feature that allows for diagram generation without requiring a local rendering setup.
Audit Metadata