Excalidraw Diagram Generator

• Analyzed: May 15, 2026, 4:24 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1363dcbeb6a43df7974b2a07671fa9b48ec013572d2f965cb412b82e066f9272
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to instructions in `SKILL.md` for the AI agent to execute local Python scripts (`add-icon-to-diagram.py`, `add-arrow.py`, `split-excalidraw-library.py`) located within the skill bundle. While presented as utility functions for diagram generation, this capability introduces a significant vulnerability risk (potential RCE via shell injection) if user-controlled input is passed unsanitized to these scripts. Additionally, `SKILL.md` repeatedly instructs the agent to use `fontFamily: 5` for text elements, which contradicts the valid font family IDs (1, 2, 3) documented in `references/element-types.md` and `references/excalidraw-schema.md`, indicating a bug that could lead to malformed output.