skills/zapabob/skills/excalidraw/Gen Agent Trust Hub

excalidraw

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the user to execute a local Python script scripts/upload.py to upload diagrams to Excalidraw. The script takes a file path as a command-line argument and performs standard file read and network operations.
  • [EXTERNAL_DOWNLOADS]: The scripts/upload.py script requires the cryptography Python package. The instructions recommend installing it via pip install cryptography, which is a standard practice for managing dependencies in development tools.
  • [SAFE]: The upload process to https://json.excalidraw.com/api/v2/post/ implements client-side encryption using AES-GCM. The encryption key is generated locally and included only in the URL fragment (after the #), ensuring the service provider cannot decrypt the diagram content. This is a well-documented and privacy-respecting feature of the official Excalidraw service.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:07 PM