excaliclaw
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data through the
[diagram topic]argument. This input is used to construct complex JSON element arrays for the Excalidraw MCP tools. The instructions do not define sanitization logic or boundary markers to ensure that malicious instructions embedded in a requested diagram topic do not influence the agent's behavior or flow into downstream tool calls. - Ingestion points:
[diagram topic]argument defined inSKILL.mdfrontmatter. - Boundary markers: None identified in the prompt construction logic.
- Capability inventory: The skill utilizes
excalidraw__create_view,export_to_excalidraw, and shell commands for package installation and configuration. - Sanitization: None present for the
[diagram topic]input. - [COMMAND_EXECUTION]: The skill defines a workflow for the agent to modify the execution environment if the Excalidraw MCP is missing. This involves checking local documentation and executing shell commands to change configurations or install packages. While these actions require explicit user approval, the capability to execute environment-modifying commands represents a security surface that could be targeted via the unsanitized diagram topic input.
Audit Metadata