canvas-export

Pass

Audited by Gen Agent Trust Hub on Jul 26, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is designed to interface with the tldraw offline desktop application. Its core functionality involves communicating with a local API server hosted by the app on the user's machine. The instructions and scripts are consistent with this purpose.
  • [COMMAND_EXECUTION]: The skill includes shell scripts (scripts/tq and scripts/new-canvas) used to interact with the local tldraw server and manage file operations. These scripts use standard tools like curl, python3 (for JSON processing), and open to facilitate the bridge between the agent and the desktop app.
  • [DATA_EXFILTRATION]: The skill reads the application's local configuration file (server.json) to obtain a port and security token. This is a documented requirement for communicating with the local tldraw server and does not involve sending data to external or third-party domains.
  • [EXTERNAL_DOWNLOADS]: The skill bundles a binary template file (assets/blank.tldraw). This is a standard application asset used to initialize new canvas documents and does not contain malicious code or unauthorized remote references.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 26, 2026, 05:42 PM
Security Audit — agent-trust-hub — canvas-export