Security audit
Security checks for vulnerabilities and agentic risk
This skill is mainly a diagram generator, but its default workflow uploads diagrams to Boardraw and searches local .env files for an API key, so it deserves review before installation.
Install only if you are comfortable with generated diagrams being uploaded to boardraw.com after confirmation. Prefer setting BOARDRAW_API_KEY explicitly in the environment rather than relying on .env discovery, and avoid using this skill for confidential architecture, org, workflow, or customer-data diagrams unless Boardraw is an approved destination.
The declared purpose is local diagram generation, but the skill also instructs reading API credentials, uploading content to a third-party service, and returning account metadata. This mismatch hides material data-flow and auth behavior from users and orchestrators, increasing the risk of unauthorized exfiltration of user content and credentials.
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
这个技能让你把用户的一句话描述（"帮我画个用户注册流程图"、"给这个项目搭个思维导图"、"画一下微服务架构"）直接转成一个可以在 Excalidraw 或 Boardraw 里打开、且元素仍然可编辑、可拖动、可连线的 `.excalidraw` 文件——而不是一张静态图片。
**Language policy: Always respond in English by default. If the user writes in any other language (e.g. Chinese, Japanese, Spanish), mirror that language for all replies in that conversation.**
**Core rule: Never hand-write raw `.excalidraw` JSON.** The format has strict `id`/`seed`/`versionNonce`/`boundElements` two-way binding requirements — hand-writing it almost always breaks things (text detaches from shapes, arrows don't snap to nodes). Always use the `ExcalidrawDoc` class in `scripts/excalidraw_builder.py` to build elements.
The skill tells the agent to upload generated whiteboard content to boardraw.com without a clear user-facing warning that their content will leave the local environment. This is particularly risky because diagrams may contain internal architecture, org charts, workflows, or other sensitive business information.
The skill instructs use of a .env file and environment variable for API credentials, and elsewhere suggests locating that secret from the directory tree. In agent contexts, prompting the system to access local secret stores can broaden credential exposure beyond user intent and facilitate accidental leakage or misuse of the API key.
1. 登录 boardraw.com → 设置 → API Keys
2. 创建新的 API Key（需要 Pro 或 Team 计划）
3. 添加到项目根目录的 .env 文件：
BOARDRAW_API_KEY=br_your_api_key_here
或者设置环境变量：
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def load_api_key() -> str:
key = os.environ.get("BOARDRAW_API_KEY", "")
if not key:
# Walk up from CWD looking for a .env file
for directory in [Path.cwd(), *Path.cwd().parents]:
env_file = directory / ".env"
if env_file.is_file():
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def load_api_key() -> str:
key = os.environ.get("BOARDRAW_API_KEY", "")
if not key:
# Walk up from CWD looking for a .env file
for directory in [Path.cwd(), *Path.cwd().parents]:
env_file = directory / ".env"
if env_file.is_file():
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if not key:
# Walk up from CWD looking for a .env file
for directory in [Path.cwd(), *Path.cwd().parents]:
env_file = directory / ".env"
if env_file.is_file():
for line in env_file.read_text().splitlines():
line = line.strip()
The skill uses sensitive capabilities—environment access, file read/write, and network—without an explicit tool/permission scope declaration. That makes the effective trust boundary unclear and can lead to over-privileged execution, especially since the instructions include credential discovery and external upload behavior.
The trigger language is very broad and may invoke the skill for generic requests to draw or map things out, increasing the chance of unintended execution. In this skill, unintended execution matters because the workflow later includes file operations and possible external upload steps.
The instructions expand the skill from file generation into automatic publication on boardraw.com, which is a materially different operation with privacy and security consequences. Users asking for a diagram file may not expect their content to be transmitted to an external workspace service.
The skill includes direct network upload instructions to an external API even though that capability is not clearly part of the declared purpose. Undisclosed network behavior is dangerous because it can transmit user-provided diagrams, embedded sensitive text, and metadata off-system without adequate notice.
The skill directs the agent to obtain credentials from environment variables or by searching upward for a .env file, which expands access beyond what is needed for local file generation. Reading discovered .env files increases the chance of unintentionally exposing or misusing unrelated secrets present in the workspace.
The curl example explicitly transmits the full whiteboard JSON to an external service along with an API key. External transmission is sensitive here because diagram contents may encode proprietary processes, infrastructure, or personal data, and the skill does not pair the upload with strong consent or minimization controls.
或者用 curl：
curl -s -X POST "https://www.boardraw.com/api/keys/auth" \
-H "Content-Type: application/json" \
-H "x-api-key: $BOARDRAW_API_KEY" \
-d "{\"whiteboard\": $(cat output.excalidraw)}"
The example content uses Chinese text labels such as "开始?" and "处理数据", and the later guidance discusses CJK rendering as a default concern. For a general-purpose builder, this can be read as implicitly steering output toward a specific language/locale without stating that the skill is region-specific or that users may choose their own language.
Detected: suspicious.exposed_secret_literal