Security audit

drawiodo

Security checks across malware telemetry and agentic risk

Overview

This draw.io skill does what it advertises, but it automatically opens local applications and prunes saved versions, so users should review those side effects before installing.

Install only if you are comfortable with the skill creating and updating .drawio files, keeping local version history, opening the draw.io desktop app automatically, and pruning older saved versions. Prefer disabling auto-preview and reviewing output paths before use, especially in shared workspaces or automated/headless environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (31)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: try: import subprocess subprocess.Popen([drawio_exe, output_path], shell=False) return {'success': True, 'message': f'preview_trigger: 已打开 draw.io 预览: {output_path}'} except Exception as e: return {
Confidence: 94% confidence
Finding: subprocess.Popen([drawio_exe, output_path], shell=False)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill advertises itself primarily as a diagram-generation tool, but the documented behavior includes additional side effects: automatic backups, version pruning/deletion, restore operations, and automatic launching of local applications/files. These behaviors expand the trust boundary and can surprise users, especially because the claimed confirm workflow is not reliably enforced, increasing the chance of unintended file mutation or local program execution.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The changelog describes a `limit_checker` hook that automatically deletes the oldest version directory when a version limit is exceeded. Automatic deletion is a destructive capability that goes beyond simple diagram generation/opening and can cause data loss if retention policy, scope, or path handling is wrong. In this skill context, version-management is related functionality, but silent deletion still increases risk because it affects user files without explicit confirmation in the changelog entry.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The changelog states that `preview_trigger` directly calls `subprocess.Popen()` to open draw.io for preview. Spawning a local process is broader than merely generating a file and can create unexpected system-side effects or become dangerous if arguments or target paths are not tightly controlled. In this skill, previewing is relevant, which lowers severity, but direct subprocess execution still deserves scrutiny and explicit declaration.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document asserts that key security constraints are enforced by Python and cannot be skipped, yet it also documents public APIs such as unregister() and clear() that can disable the very hooks providing those guarantees. This creates a dangerous trust gap: downstream components or operators may rely on protections that are in fact removable, enabling bypass of backup, validation, and cleanup controls.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The documentation states the LLM cannot skip automatic preview, but elsewhere explicitly shows unregister('post_iterate', 'preview_trigger') to disable that behavior. This contradiction weakens security assumptions and can be used to suppress a claimed mandatory control, indicating the system's guarantees are not actually enforced as documented.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The report contains materially contradictory statements: an early summary shows multiple FAIL results, while later sections claim high pass rates and '无发现问题'. In a security-sensitive skill, inconsistent test evidence can mislead reviewers into trusting controls that may not actually work, weakening assurance and enabling unsafe deployment decisions.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The statement '功能测试: 283/283 通过' directly conflicts with the detailed D1-D6 section, which contains numerous FAIL entries. This creates false assurance about the skill's quality and may cause operators to overlook real operational or safety issues in file-handling and workflow logic.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: The '无发现问题' conclusion is contradicted by explicit failed and warning findings listed later in the same report. While not code execution by itself, this masks known issues and undermines the credibility of the testing and review process around a skill that creates and opens files.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The CLI self-check traverses all hook points, including the post-iterate preview hook, so a diagnostic command can launch the local draw.io application as a side effect. Utilities intended for inspection or validation should not perform external actions, especially process creation, because this breaks operator expectations and can be abused in automation or CI contexts.

Context-Inappropriate Capability

Medium

Confidence: 77% confidence
Finding: Automatically launching a desktop application is a side effect beyond pure diagram generation and expands the skill's ability to interact with the host. In an agent setting, this is dangerous because it can trigger unexpected GUI execution, open attacker-influenced files if upstream data ever becomes user-controlled, and violate least-privilege expectations even without command injection.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The test script automatically launches a desktop application and opens every .drawio file in the output directory, which exceeds a normal non-interactive test script's role and creates an unsafe side effect. In an agent-skill context, unexpected GUI launches can violate user expectations, trigger local application behavior on attacker-influenced files, and expand the attack surface beyond file generation.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger patterns are broad and include everyday phrases such as requests to 'make a chart' or references to common diagram terms, which can cause the skill to activate in contexts the user did not intend. Because the skill has write and shell-adjacent capabilities and performs automatic side effects, accidental activation can lead to unwanted file generation or local application launch.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: A catch-all activation condition makes the skill boundary ambiguous, so unrelated requests that merely resemble diagramming tasks may invoke the skill. In this context, ambiguity is risky because invocation is tied to file writes, backups, version operations, and automatic preview behavior rather than being read-only.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents automatic file opening and automatic backup/version actions without clearly foregrounding that these are local system side effects. Users may expect simple content generation, but the skill can create files, alter version history, and launch a desktop application automatically, which increases the risk of surprise execution and unintended persistence of local artifacts.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description declares very broad activation conditions such as any request to draw diagrams, charts, UML, ER, sequence, or mind maps, which can overlap with many ordinary user prompts and cause the skill to trigger unexpectedly. Over-broad triggering increases the chance the agent routes unrelated requests into this skill, potentially causing unwanted file generation, tool use, or bypass of more appropriate skills.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The description states behavior in Chinese without indicating that language should follow user preference, which can override expected interaction norms and create confusion during confirmation or safety-sensitive steps. In a workflow that includes iterative editing and validation, forcing a language can degrade user understanding and informed approval, especially for non-Chinese-speaking users.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The changelog documents automatic deletion of old versions without any visible warning or consent language. Even if intended as routine cleanup, silent destructive behavior can surprise users and erase revision history they expected to keep, especially in an iterative design workflow. The skill context makes cleanup somewhat understandable, but the lack of warning makes it unsafe-by-default.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The changelog indicates that preview is launched automatically via subprocess, but does not mention the system-side effect of opening a local application. This can surprise users, disrupt workflows, or mask unsafe command execution pathways if process invocation is not controlled. In context, auto-preview is aligned with the skill purpose, so the impact is limited but still real.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The FAQ states that generated diagrams are written to the workspace and that up to five historical versions are retained, but it does not warn users that files will be created and preserved locally. In an agent context, silent file creation and retention can expose sensitive architecture or workflow information to other tools, users, or later sessions sharing the same workspace.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The guide explicitly states that older versions are automatically deleted when limits are exceeded, but it does not require a user-facing warning, confirmation, or retention-policy disclosure before destructive actions occur. In a versioning workflow, silent deletion can cause unintended data loss and weakens the user's ability to make informed decisions about rollback and preservation.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The documentation describes automatic preview opening, backup creation, version initialization, and filesystem modifications as mandatory behavior, but it does not clearly warn that these actions will launch applications and modify local files. This creates a safety and consent issue because the agent may trigger system-impacting behavior without clear user awareness.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill describes automatically launching draw.io via subprocess after file generation without documenting an explicit user consent step or warning that an external GUI application will open. In an agent context, unexpected application launch can surprise users, disrupt workflows, and increase the risk of unsafe handling of attacker-influenced output paths or files.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The documentation describes automatic deletion of the oldest version directories and logs once a limit is reached, but does not mention any user warning, confirmation, or safety constraints. In a file-managing skill, silent destructive cleanup can cause irreversible data loss, especially if version metadata or paths are miscomputed or attacker-influenced.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Automatically opening draw.io after generation performs an external action without warning or approval from the user. In an agent skill context, this is more dangerous because the hook is explicitly described as mandatory and non-bypassable, so ordinary file generation can unexpectedly spawn local applications and interact with user desktop state.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.