excalidraw
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user to execute a local Python script
scripts/upload.pyto upload diagrams to Excalidraw. The script takes a file path as a command-line argument and performs standard file read and network operations. - [EXTERNAL_DOWNLOADS]: The
scripts/upload.pyscript requires thecryptographyPython package. The instructions recommend installing it viapip install cryptography, which is a standard practice for managing dependencies in development tools. - [SAFE]: The upload process to
https://json.excalidraw.com/api/v2/post/implements client-side encryption using AES-GCM. The encryption key is generated locally and included only in the URL fragment (after the#), ensuring the service provider cannot decrypt the diagram content. This is a well-documented and privacy-respecting feature of the official Excalidraw service.
Audit Metadata