Publish Ascii Excalidraw

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed ASCII-to-Excalidraw converter that writes diagram files and intermediate JSON to a dedicated local folder.

Install only if you are comfortable with generated diagrams and intermediate module JSON being saved persistently under ~/.excalidraw/. Avoid using sensitive architecture or workflow diagrams unless you plan to manage or delete those local files afterward.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill description promises end-to-end ASCII parsing and Excalidraw generation, but the detected behavior appears centered on merging preexisting module JSON files instead. This mismatch can mislead users and security reviewers about what the skill actually does, weakening trust boundaries and making unexpected file operations or dependency on external module content more likely.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to create directories and write files under `~/.excalidraw/`, but it declares no explicit tool scope or allowed-tools restrictions. That creates an authorization gap where a caller may not realize the skill needs filesystem write access, increasing the chance of unintended local file modification.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Default output: `~/.excalidraw/`**. All `.excalidraw` files and intermediate module JSONs MUST be saved here. Never use `/tmp/` or the user's home directory root for output.

Before starting, create the directories:

```bash
mkdir -p ~/.excalidraw/modules

• Confidence: 90% confidence
• Finding: The skill mandates persistent writes to `~/.excalidraw/` and explicitly discourages ephemeral locations like `/tmp/`. Persistent storage can retain user-provided diagram content and intermediate artifacts across sessions, which may expose sensitive architecture or workflow information to later processes or users on the same account.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Between modules**, maintain consistent coordinate space. Track cursor positions so subsequent modules align properly.

Write each module to a JSON file under `~/.excalidraw/modules/`:
```
~/.excalidraw/modules/module_1.json
~/.excalidraw/modules/module_2.json

• Confidence: 91% confidence
• Finding: Writing every intermediate module JSON to `~/.excalidraw/modules/` increases the persistence surface beyond the final output file. These artifacts may contain partial diagram data, labels, or internal structure that remain on disk after completion, creating unnecessary retention of potentially sensitive content.

Vague Triggers

Low

• Confidence: 87% confidence
• Finding: The README tells users to trigger the skill with `/ {name}`, but it does not define the actual trigger phrase or any scope constraints for when this skill should be invoked. In a markdown skill description, this lack of specificity can make activation conditions unclear and leaves no negative examples or exclusion conditions.

Static analysis

No suspicious patterns detected.