draw-io
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill contains automation scripts such as
scripts/export-drawio.mjsandscripts/convert-drawio-to-png.shthat invoke external command-line tools. - These scripts specifically interface with the
drawiodesktop application CLI to process diagram files. - Execution is performed using
child_process.spawn, which correctly handles arguments as a list to mitigate injection risks. - [EXTERNAL_DOWNLOADS]: The documentation and repository structure include several links to external resources for user assistance.
- Links point to official documentation for draw.io and related GitHub repositories used as references for the skill's development.
- [SAFE]: The skill operates entirely within the expected domain of diagram management.
- No evidence of prompt injection, unauthorized data access, or obfuscated malicious payloads was detected.
- The logic used in the SVG linter (
scripts/check-drawio-svg-overlaps.mjs) is focused on geometric calculations to ensure diagram quality.
Audit Metadata