tldraw 板书工坊

• Outcome: Review
• Latest audit: Jul 30, 2026 · 9:29 AM UTC
• Version: 1.0.1

Overview

The skill is a real tldraw board-making helper, but it exposes a local bearer token and broad document-editing access to the agent with limited scoping or warning.

Review before installing. This skill is suitable only if you are comfortable letting an agent use your local tldraw Desktop API, read the open-canvas list, and run editing JavaScript against documents. Treat server.json and its token as sensitive; avoid sharing logs or prompts that include it, and prefer a scoped helper or explicit per-document consent if available.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: A board-formatting skill should not silently read local configuration, extract bearer tokens, enumerate open documents, or inject that metadata into agent context unless those actions are explicitly declared and narrowly scoped. If the referenced behavior is real, it creates a serious confidentiality risk by exposing local auth material and document state unrelated to the user's visible request.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script injects a localhost server URL, bearer token, and a snapshot of open tldraw documents into agent context, which materially expands the agent's access beyond the stated purpose of making board-style drawings. Even though the data is sourced locally, exposing credentials and document inventory to the agent enables unauthorized access to user canvases and increases the chance of downstream prompt leakage or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads a bearer token from a local config file and passes it to the agent along with instructions to use it on every request, effectively granting the agent authenticated access to the local canvas server. That capability is not clearly necessary for a board-formatting skill and could be abused to enumerate or manipulate user documents.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The script is presented as a board/canvas helper, but it exposes a generic authenticated wrapper around the local tldraw API that can invoke arbitrary endpoints and submit arbitrary request bodies, including raw JavaScript to execution endpoints shown in the usage comments. This materially expands capability beyond the stated styling purpose and could be abused by a skill or user to execute unintended actions against local documents or the editor context with the user's bearer token.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script silently reads a sensitive auth token from disk and transmits it into agent context without any user-facing warning, consent, or audit boundary. Secrets embedded in prompt/context are especially risky because they may be logged, echoed, reused by other tools, or exfiltrated through later model actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs operators to read a bearer token from a local config file and use it for authenticated API calls, but it provides no warning that this token is a sensitive secret that grants access to the local tldraw server. In a skill context, normalizing direct secret extraction and reuse increases the chance of credential exposure through logs, copied commands, downstream agents, or misuse by untrusted code operating in the same environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to read a bearer token directly from a local configuration file and immediately use it in API requests, but it provides no warning about treating that token as a secret or limiting where it is exposed. Because the documented API can execute code against local documents, disclosure or unsafe handling of this token could enable unauthorized local document access and modification.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly states that the skill depends on a local configuration file containing a `token` used for API authentication, but gives no warning to avoid exposing, copying, logging, or sharing that credential. In an agent-skill context, encouraging users to inspect or rely on a token-bearing file without credential-handling guidance increases the chance of accidental token disclosure and unauthorized local API access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the user to run JavaScript in an `exec` context that mutates the live document by creating and appending a `<style>` element to `document.head`. Although the code is not overtly malicious and is intended for font styling, it normalizes a dangerous workflow—direct DOM/script injection—without warning about side effects, trust boundaries, rollback, or environment restrictions. In an agent/tooling context, encouraging arbitrary `exec` usage increases the chance that users or downstream agents execute modified code with broader impact than expected.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script silently reads a bearer token from a local config file and attaches it to every request without any warning, prompt, or scope limitation. Even though the destination is localhost, this still grants any caller of the script authenticated access to the local tldraw service and can enable unauthorized actions within the user's session.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.