excalidraw

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [SAFE]: The skill is designed to assist with diagram generation and uses standard file-saving procedures. No malicious behavioral patterns were detected.\n- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script (scripts/upload.py) to facilitate diagram sharing. This is a legitimate functional requirement of the skill.\n- [EXTERNAL_DOWNLOADS]: The included upload script requires the cryptography Python package. This is a standard library used for implementing secure encryption.\n- [DATA_EXFILTRATION]: The skill includes a feature to upload diagram data to excalidraw.com. This is an intended feature for sharing diagrams. The script correctly implements client-side encryption (AES-GCM), ensuring the hosting service cannot read the diagram content, which aligns with best practices for data privacy on well-known third-party services.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 09:43 AM
Security Audit — agent-trust-hub — excalidraw