tldraw-offline
Fail
Audited by Snyk on Aug 12, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E004: Prompt injection detected in skill instructions.
- Potential prompt injection detected (high risk: 0.80). The skill contains explicit instructions to bypass the app's "Run Script" consent dialog (use foreground delivery / bring_to_front and synthetic clicks), which directs the agent to circumvent a user-consent/security control and is outside the stated purpose of scripting the canvas via the local API.
Issues (1)
E004
CRITICALPrompt injection detected in skill instructions.
Audit Metadata