tldraw-offline
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlcommands to interact with a local API endpoint (http://localhost:7236) provided by the tldraw offline application. This is the intended communication mechanism for the skill's purpose. - [COMMAND_EXECUTION]: Shell commands (using
jqorpython3) are provided to extract the API port and bearer token from a local configuration file (server.json) located in standard application support directories. This is a standard practice for local service authentication. - [REMOTE_CODE_EXECUTION]: The skill mentions downloading the tldraw offline application from the official GitHub releases page (
https://github.com/tldraw/tldraw-offline/releases/latest). This is a reference to a well-known project and is considered safe for the context of installing required software. - [DATA_EXPOSURE]: The skill reads from the application's local
server.jsonto obtain a session token. Access is limited to the local machine and the specific application's data, which is necessary for the agent to authenticate its requests to the local tldraw API.
Audit Metadata