ClawHub

Excalidraw Architect

v1.0.0

Build or revise architecture diagrams directly in excalidraw.com from natural-language requirements. Use when the user asks to draw, update, clean up, or res...

⭐ 0· 85·0 current·0 all-time
by@energypantry
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (edit Excalidraw diagrams) matches the included artifacts: a browser-evaluate API discovery snippet and a Python helper that converts a spec to Excalidraw element JSON. No unrelated credentials, binaries, or external services are requested.
ℹ
Instruction Scope
Runtime instructions require executing code in the page context and traversing React fiber internals (looking for __reactFiber$* and memoizedProps.excalidrawAPI). This is fragile and accesses page-internal props, but it is necessary to obtain the excalidrawAPI and then calls api.updateScene/api.scrollToContent to modify the canvas. The behavior is coherent with the skill's purpose but can touch other in-page data if present.
✓
Install Mechanism
No install spec; the skill is instruction-only with two small helper files. Nothing is downloaded or written to disk by an installer, so install risk is low.
✓
Credentials
The skill requires no environment variables, credentials, or config paths. The included code operates locally/in-page and writes element JSON to a local file only when the Python helper is used.
✓
Persistence & Privilege
always is false and the skill does not request elevated or persistent system presence. It can be invoked autonomously per platform defaults; paired with the lack of broad credentials this is not a high risk, though autonomous edits to open Excalidraw boards are possible.
Assessment
This skill appears to do what it claims: it runs small scripts and uses a browser evaluate call to find Excalidraw's runtime API and update the canvas. Before installing, be aware that: (1) it executes code inside the Excalidraw page and traverses React fiber internals — that is necessary to get the excalidrawAPI but could access other in-page state if present; (2) it will modify whatever Excalidraw board the agent has open, so test on a throwaway board first; (3) there are no external uploads or credential requests. If you want extra safety, require user confirmation before any edit (disable autonomous invocation for this skill or configure the agent to prompt) and review/modify the provided snippets so evaluate calls are limited to the excalidraw.com origin.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ah3qray2w3sz6hp4jxxnxch83msbn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments