drawio
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script uses a headless web browser via Puppeteer (
puppeteer-core) to fetch a static diagram viewer JavaScript file from the well-known external web domainhttps://viewer.diagrams.net/js/viewer-static.min.js. This is done inside a browser environment during runtime to parse and convert visual shapes when a local desktop installation is absent. - [COMMAND_EXECUTION]: The script searches for an installed draw.io desktop binary path (
drawio/draw.io.exe) on the host file system and useschild_process.spawnSyncto execute the native application for high-performance offline rendering.
Audit Metadata