mindmap
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell scripts (
scripts/tqandscripts/new-canvas) to automate the creation of.tldrawfiles and to communicate with the tldraw offline application's local API bridge. - [SAFE]: The skill accesses the local
server.jsonfile to retrieve the necessary port and token for communicating with the tldraw application. This is the intended architecture for the integration and does not involve external data exfiltration. - [SAFE]: The skill processes user-supplied outlines to generate diagrams. While this represents a surface for indirect prompt injection, it is the primary function of the skill and operates within the local application environment.
- Ingestion points: User-provided nested outlines (bullets/tree) described in
SKILL.md. - Boundary markers: None explicitly specified for the input outline.
- Capability inventory: Local shell execution and JavaScript execution via the tldraw API.
- Sanitization: The workflow relies on the agent to correctly parse and normalize labels for the diagram.
Audit Metadata