tldraw-offline

Fail

Audited by Snyk on Aug 12, 2026

Risk Level: CRITICAL
Full Analysis

CRITICAL E004: Prompt injection detected in skill instructions.

  • Potential prompt injection detected (high risk: 0.80). The skill contains explicit instructions to bypass the app's "Run Script" consent dialog (use foreground delivery / bring_to_front and synthetic clicks), which directs the agent to circumvent a user-consent/security control and is outside the stated purpose of scripting the canvas via the local API.

Issues (1)

E004
CRITICAL

Prompt injection detected in skill instructions.

Audit Metadata
Risk Level
CRITICAL
Analyzed
Aug 12, 2026, 03:36 PM
Issues
1
Security Audit — snyk — tldraw-offline