v1.0.0

Excalidraw Architect

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:24 AM.

Analysis

The skill is purpose-aligned for creating Excalidraw diagrams, with the main caution that it runs page JavaScript and can replace the active canvas contents.

GuidanceThis looks safe for its stated purpose. Before installing, note that it directly controls the active Excalidraw page and may rewrite the canvas, so use it on the correct board and request preservation/backups for important existing diagrams.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

Call `api.updateScene({ elements, appState })` ... When user requests changes, rewrite the scene deterministically

The skill is explicitly allowed to mutate the active Excalidraw canvas, and its normal workflow may replace the scene contents.

User impactIf used on the wrong open board, existing diagram content could be replaced or changed.

RecommendationUse it only on the intended Excalidraw board and ask it to preserve or back up existing elements when revising important diagrams.

Unexpected Code Execution

SeverityInfoConfidenceHighStatusNote

SKILL.md

Use an `evaluate` action to locate `excalidrawAPI` from the React fiber tree.

The skill runs JavaScript in the Excalidraw page context to discover and call the page runtime API; this is disclosed and central to the diagramming function.

User impactThe agent will execute page-context JavaScript on excalidraw.com to create or update the diagram.

RecommendationInvoke the skill only when you want the agent to control the Excalidraw page, and avoid using it on unrelated open boards.