activity-diagram
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed to interact with the tldraw offline desktop application via a local HTTP bridge (localhost:7236). This communication is restricted to the user's machine and utilizes a per-launch bearer token stored in the application's local configuration directory.
- [SAFE]: All shell scripts (
scripts/tqandscripts/new-canvas) perform standard administrative tasks such as directory creation, file copying, and local API requests usingcurl. No external network communication was detected beyond the intended local interaction. - [SAFE]: The skill uses binary assets (
assets/blank.tldraw) as templates, which is a standard practice for this platform. The documentation in thereferences/directory provides clear guidelines on style, UML notation, and layout algorithms without any hidden or malicious instructions. - [SAFE]: The skill correctly implements idempotency by using stable IDs and metadata tagging (
meta.kckit), ensuring that re-running the skill updates existing diagrams rather than creating duplicates or clobbering user data.
Audit Metadata