present
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes a local HTTP API provided by the tldraw offline desktop application to manipulate canvas elements. Communication is restricted to
localhost. - [SAFE]: It handles a local per-session bearer token found in the application's
server.jsonfile. This is a standard mechanism for local app integration and no data is transmitted to external servers. - [SAFE]: The skill provides legitimate JavaScript templates for 'document scripts' that extend the tldraw SDK to provide keyboard navigation and sidebar overlays. These scripts are executed within the tldraw application's environment.
- [SAFE]: All filesystem interactions are scoped to the user's
~/canvasdirectory and the application's internal script workspace, following documented best practices for the tool. - [SAFE]: The research doctrine included in the skill references only official and well-known documentation sources for technical implementation details.
Audit Metadata