excalidraw
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill generates static JSON files and uses a local Python script for uploads. All network activity is directed to the official Excalidraw API (
json.excalidraw.com) for its intended purpose of sharing diagrams. - [EXTERNAL_DOWNLOADS]: The skill requires the standard
cryptographyPython package for client-side encryption of diagrams before upload. This is a well-known, trusted cryptographic library. - [COMMAND_EXECUTION]: The skill documentation suggests running a local Python script (
scripts/upload.py) to upload diagrams. The script performs client-side AES-GCM encryption so that the server never sees the plaintext diagram content, which is a security best practice for this service.
Audit Metadata