draw-io

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill contains automation scripts such as scripts/export-drawio.mjs and scripts/convert-drawio-to-png.sh that invoke external command-line tools.
  • These scripts specifically interface with the drawio desktop application CLI to process diagram files.
  • Execution is performed using child_process.spawn, which correctly handles arguments as a list to mitigate injection risks.
  • [EXTERNAL_DOWNLOADS]: The documentation and repository structure include several links to external resources for user assistance.
  • Links point to official documentation for draw.io and related GitHub repositories used as references for the skill's development.
  • [SAFE]: The skill operates entirely within the expected domain of diagram management.
  • No evidence of prompt injection, unauthorized data access, or obfuscated malicious payloads was detected.
  • The logic used in the SVG linter (scripts/check-drawio-svg-overlaps.mjs) is focused on geometric calculations to ensure diagram quality.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 08:35 AM