Security audit
Security checks for vulnerabilities and agentic risk
This skill generates local Excalidraw PM diagrams from user-provided product notes, with disclosed local file creation and no evidence of network access, persistence, credential use, or destructive behavior.
Install only if you are comfortable with the skill writing a temporary JSON file and an Excalidraw output file locally. Use a dedicated folder, review the output path before running it, and delete only the temporary input file the skill created.
The skill performs file creation and deletion and instructs running a local script, but it declares no explicit tool scope or permissions. That mismatch can cause an agent or user to invoke filesystem-capable actions without clear boundary-setting, increasing the chance of unintended writes to sensitive locations or execution in contexts that should have been restricted.
The workflow tells the agent to create a temporary JSON file and later delete it without warning the user that data will be written to disk and removed afterward. Even if the content is ordinary PM data, silent filesystem side effects can surprise users, leave sensitive business information on disk if cleanup fails, or delete the wrong file if the temp path is not tightly controlled.
No suspicious patterns detected.
