excalidraw
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install the
@excalidraw/excalidrawpackage along with its peer dependenciesreactandreact-domfrom the official NPM registry. These are well-known and standard libraries for building interactive web whiteboards. - [INDIRECT_PROMPT_INJECTION]: The skill provides logic for importing data from
.excalidraw(JSON) files via theloadFromFilefunction. - Ingestion points: The
file.text()andJSON.parse(text)operations inSKILL.mdprocess user-provided files. - Boundary markers: The function relies on the structural integrity of the JSON format.
- Capability inventory: The ingested data is used strictly to update the visual state of the Excalidraw component within the browser. No access to the file system, network exfiltration, or shell command execution is present.
- Sanitization: Standard JSON parsing is used to ensure the data adheres to a valid structure before processing.
Audit Metadata