excalidraw

SUSPICIOUS: the skill is mostly aligned with diagram generation, but its default SVG workflow sends diagram data to a third-party Kroki service, and PNG export depends on a separately published third-party CLI plus browser install. No credential harvesting, secret-file access, or stealth behavior is present, so this looks like a workflow with moderate privacy and supply-chain risk rather than malware.