OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill provides tools for an agent to manage Excalidraw diagrams and libraries. While the code is functional and uses standard libraries, it introduces a high risk of Indirect Prompt Injection. The agent is required to process external JSON data (icon libraries and diagram files) which can contain embedded instructions. Because the agent also has file-system write capabilities to modify diagrams, a malicious library could hijack the agent's logic during the diagram generation process.
Detected behaviors
No alerts
No issues
16/16 files flagged
1 finding · Score: 86/100