Security audit

draw.io Diagrammer

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a normal draw.io diagram-generation helper that creates and reviews local diagram files, with no evidence of hidden data access or harmful behavior.

Install this if you want agents to create editable draw.io diagrams and PNG previews. Be aware that vague visualization requests may trigger file creation/export work, and review generated diagrams or share links before distributing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill description is broad enough to match many ordinary requests involving diagrams or visualization, which can cause the agent to invoke this skill more often than intended. Over-broad activation increases attack surface by routing unrelated prompts into a tool-enabled workflow that writes files and runs external binaries, raising the chance of misuse or unsafe execution in the wrong context.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The listed trigger phrases include generic terms like "diagram," "flowchart," and "visualize this process," which lack clear constraints and may match ambiguous user requests. In this skill, that is more dangerous because activation leads to filesystem writes and command-line export steps, so accidental invocation can trigger unnecessary tool use and broaden exposure to prompt-driven abuse.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.