activity-diagram

Pass

Audited by Gen Agent Trust Hub on Jul 26, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is designed to interact with the tldraw offline desktop application via a local HTTP bridge (localhost:7236). This communication is restricted to the user's machine and utilizes a per-launch bearer token stored in the application's local configuration directory.
  • [SAFE]: All shell scripts (scripts/tq and scripts/new-canvas) perform standard administrative tasks such as directory creation, file copying, and local API requests using curl. No external network communication was detected beyond the intended local interaction.
  • [SAFE]: The skill uses binary assets (assets/blank.tldraw) as templates, which is a standard practice for this platform. The documentation in the references/ directory provides clear guidelines on style, UML notation, and layout algorithms without any hidden or malicious instructions.
  • [SAFE]: The skill correctly implements idempotency by using stable IDs and metadata tagging (meta.kckit), ensuring that re-running the skill updates existing diagrams rather than creating duplicates or clobbering user data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 26, 2026, 05:42 PM
Security Audit — agent-trust-hub — activity-diagram