excalidraw-diagram-generator
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the Excalidraw web application and library repository at excalidraw.com. These are well-known services used for the skill's intended purpose of diagram creation and management.
- [COMMAND_EXECUTION]: The skill utilizes local Python scripts (add-arrow.py, add-icon-to-diagram.py, split-excalidraw-library.py) to manage diagram elements and icon libraries. These scripts perform standard JSON processing and file system operations without any arbitrary shell execution or network requests.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language to generate diagram data. While this presents an ingestion surface, the risk is negligible as the generated content is limited to visual labels in a diagram file. Evidence chain: 1. Ingestion points: User-provided natural language descriptions. 2. Boundary markers: Absent for text labels within the generated JSON elements. 3. Capability inventory: Local file writing and execution of provided Python scripts. 4. Sanitization: Implementation uses json.dump to ensure safe serialization of user input into the diagram files.
Audit Metadata