PM Toolkit - Excalidraw - "Messy Thoughts" to "Visual Spec" in 30 seconds.

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing and using the skill means allowing a local helper script to run and create files on the machine.

Why it was flagged

The skill directs the agent/user to execute a bundled local Python script and write an output diagram file. This is expected for the stated purpose and the visible code uses local JSON/file operations rather than network or credential access.

Skill content
python3 skills/pm-visualizer/scripts/layout_diagram.py temp_visual_data.json ~/Downloads/Documents/PM_Visuals/Output_Name.excalidraw
Recommendation

Keep the output path in a normal user-writable folder and review generated files before sharing them.

What this means

Users must rely on the provided artifact contents rather than an external project page or repository for trust context.

Why it was flagged

The skill includes runnable local code but does not provide an external source or homepage for provenance. The referenced script is included in the artifact set and no remote install, unpinned package, or hidden dependency is shown.

Skill content
Source: unknown; Homepage: none
Recommendation

Review the bundled script before use if provenance matters in your environment.