ClawHub
Back to skill

Security audit

Excalidraw Architect

Security checks across malware telemetry and agentic risk

Overview

This skill appears aligned with creating Excalidraw architecture diagrams, with the main caveat that it can directly change the open canvas.

Install this only if you want an agent to control Excalidraw directly. Use it on the intended board, and ask for preservation, export, or confirmation before large revisions to important existing diagrams.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation language is broad enough to match many ordinary requests about diagrams, restructuring, or workflows, increasing the chance the skill is invoked outside the user's intended context. Because the skill directs browser evaluate actions and runtime API discovery on a live page, accidental activation can cause unintended page manipulation or tab reuse against an existing user board.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The snippet programmatically calls Excalidraw's runtime API to overwrite scene elements and adjust app state without any built-in confirmation, disclosure, or provenance indicator. In a skill designed to edit diagrams from natural-language requests, this can cause silent modification of a user's open document, making accidental or unauthorized changes harder for the user to notice or attribute.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.