Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Excalidraw diagram-generation helper that uses local Docker, browser automation, and file writes in ways that fit its stated purpose.
Install only if you are comfortable with a skill that can start or use a local Docker canvas service, run browser-based export JavaScript, move generated image files, and update Markdown where you ask it to. Give exact output paths and review any proposed file edits before applying them.
The trigger list contains broad, common phrases such as '画图', '创建图表', and '生成图表', which can match ordinary user requests and cause the skill to activate unintentionally. Because this skill can start Docker, run local commands, download files, move files, and modify Markdown content, accidental invocation expands the chance of unexpected local side effects.
The skill explicitly instructs moving generated files into arbitrary local paths and inserting image references into Markdown files, but it does not require user confirmation, path validation, or safety warnings. In context, this is more dangerous because the same skill also performs automated browser downloads and shell commands, so a misinterpreted request or crafted prompt could lead to unintended overwrites or modifications of repository files.
No suspicious patterns detected.
