Security audit

Excalidraw Diagram Generator

Security checks for vulnerabilities and agentic risk

Overview

This diagram skill is related to its stated purpose, but its default PNG export runs browser automation with network-loaded code and weakened browser isolation, so it needs review before use.

Install only if you are comfortable with the PNG export path running Playwright/Chromium and loading remote JavaScript. Avoid exporting sensitive diagrams with the bundled exporter unless dependencies are pinned or vendored, browser sandboxing is restored or isolation is added, and PNG export is made explicit opt-in. Plain .excalidraw JSON generation is much lower risk than the automatic PNG export path.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/export-png.py:29
Finding: JavaScript Injection Through Unescaped Excalidraw JSON
Content: View full analysis
str: return f"""
`. An attacker can place such a sequence inside a valid Excalidraw text property, terminate the containing script element, and append a new attacker-controlled script element. The resulting payload executes when Playwright visits the generated `render.html` page. Execution occurs before the Excalidraw export completes and in a browser configured with outbound network access and disabled Chromium sandboxing. ### Attack Path 1. An attacker creates a syntactically valid `.excalidraw` document. 2. A string property, such as an element's `text` value, contains an HTML-breaking payload based on ``. 3. A user or automated agent invokes `export-png.p ...[truncated 1238 chars]
Remediation: View remediation
`, `&`, U+2028, and U+2029 before insertion. - Validate the top-level Excalidraw schema and impose limits on input size, element count, and string lengths. - Add regression tests containing ``, HTML tags, Unicode separators, and malformed data. - Enable Chromium sandboxing and restrict browser egress to reduce the effect of any future rendering injection. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/export-png.py:33
Finding: Runtime Retrieval and Execution of Mutable Remote JavaScript
Content: View full analysis
``` ### Technical Analysis Every PNG export downloads and executes JavaScript from `unpkg.com`. The React and ReactDOM URLs use a mutable major-version selector (`@18`), while Excalidraw is version-pinned but still retrieved remotely. None of the resources are protected with Subresource Integrity or verified against a locally maintained digest. Consequently, the effective code executed by the skill is not fully represented by the audited repository. A CDN compromise, package publication compromise, mutable package resolution, or upstream account compromise could change exporter behavior after review. The downloaded code runs in the same page that receives the complete diagram as `DATA`. It therefore has direct access to diagram content. Chromium is also launched without its sandbox, increasing the consequences of malicious remote code combined with a browser vulnerability. ### Attack Path 1. An upstream package, package-publishing account, CDN, or delivery path is compromised or serves an unexpected mutable release. 2. The user invokes the default PNG export process. 3. Playwright loads the locally generated page. 4. The page downloads the remote scripts from unpkg. 5. The browser executes the remotely supplied payload without integrity verification. 6. The payload accesses the in-page diagram data, changes the exported image, or transmits information to an attacker-controlled service. 7. If the payload exploits a Chromium vulnerability, disabled sandboxing m ...[truncated 706 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:21
Finding: Unpinned Package Installation Instructions Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/export-png.py:124
Finding: Chromium Security Sandbox Is Explicitly Disabled
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is generating Excalidraw JSON from natural language, but the documented behavior also includes executing a local Python export script, browser automation, and network-loaded rendering resources. This mismatch is dangerous because users may approve a low-risk content-generation skill without realizing it can launch subprocesses and perform network-dependent actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx clawhub@latest install excalidraw-diagram, which pulls and executes remote code without pinning a specific trusted version. If the upstream package is compromised or a breaking/malicious release is published, users could execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill performs file read/write actions but does not declare any explicit tool scope or permissions boundary. This weakens least-privilege controls and can allow broader filesystem access than users or the platform may expect when invoking a diagram-generation skill.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: excalidraw-diagram description: "Generate Excalidraw hand-drawn diagrams from natural language. Use when asked to create diagrams, flowcharts, mind maps, architecture diagrams, ER diagrams, or sequence diagrams. Outputs .excalidraw JSON files. Triggers: draw diagram, create flowchart, visualize, architecture diagram, excalidraw." license: MIT metadata: author: WanSan Team (OpenClaw)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description lists triggers including "visualize", which is a broad, common verb that can overlap with many ordinary requests unrelated to Excalidraw diagram generation. The trigger list also does not provide exclusion conditions or negative examples to narrow when the skill should or should not activate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill content and operational instructions are written entirely in Chinese and do not offer any language or locale choice to the user. This can constitute a language policy violation when a skill implicitly forces one language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation broadens the skill from JSON generation into automatic PNG export using external rendering behavior and network-dependent resources. Expanding execution beyond the advertised output format increases attack surface and can trigger unexpected data exposure or remote resource loading during normal use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill defaults to automatic PNG export through a subprocess that may require network access, but it does not require an explicit warning or fresh user consent before doing so. Silent execution of network-dependent actions can expose user content to remote resources and violates user expectations for a local diagram-generation task.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs execution of a local Python script plus installation of Playwright and Chromium, which introduces code execution and dependency risk not necessary for core diagram generation. Even if the script is local, invoking interpreters and installing packages materially increases the blast radius compared with plain file generation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents all instructional content in Chinese and does not indicate that language selection is optional or configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file consistently presents prompts, analysis text, and output labels only in Chinese, such as the examples at L001-L009 and the prompt patterns table at L338-L350. Because the file does not offer an opt-in language choice or justify a Chinese-only scope, it creates a natural-language locale policy issue for users expecting language flexibility.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented script sends local .excalidraw content to https://excalidraw.com in a headless browser, which introduces external network dependency and potential data exposure beyond the skill’s stated purpose of generating JSON diagrams. Even if intended for rendering, loading a third-party site means diagram contents may be processed in an environment outside the local trust boundary, and the use of --no-sandbox further weakens containment if the browser is compromised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow explicitly requires network access to a third-party website for export, which broadens the skill’s capabilities from local diagram generation to remote content handling. In the context of a skill advertised as producing .excalidraw JSON files, this mismatch increases the risk of unanticipated data egress, privacy issues, and supply-chain exposure if the remote application changes or is tampered with.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The exporter injects unpinned executable JavaScript from third-party CDNs into a browser context to process user-supplied diagram data. This creates a supply-chain and data-exposure risk: compromised CDN content or unexpected library changes could execute arbitrary code during export, and the network dependency is unnecessary for a local file conversion workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script loads third-party browser libraries over the network without warning the user that their diagram content will be rendered in a page that performs external HTTP requests. Even if the data is only embedded locally, this introduces privacy, compliance, and integrity concerns because sensitive diagram contents are processed in a network-enabled browser session dependent on external services.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest says the skill outputs .excalidraw JSON files, implying the skill's scope is producing diagram source files. This script instead renders diagrams in a browser context and writes a .png image to disk, which is a materially different output behavior than the manifest advertises.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file states that the skill will save a .excalidraw file to the current working directory or a specified path, which is a file write affecting user data and workspace state. The description does not include any caution about where files are written, potential overwrites, or the need to verify the destination path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The title and the entire specification are written in Chinese, and the examples require Chinese text such as "节点文字" and "标签内容" without indicating that language choice is optional. This can be a language/locale policy issue because it implicitly forces a specific language without user opt-in or a documented region-specific reason.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.