excalidraw-skill

Fail

Audited by Runlayer on Feb 22, 2026

Risk Level: HIGH
Scan Summary
Max Score
90%
Files
9
Flagged
9
Chunks
11
Flagged Files (9)
SKILL.mdHIGH
90.1%

Malicious tool definition detected

--- # Excalidraw Skill ## Step 0: Detect Connection Mode Before doing anything, determine which mode is available. Run these checks **in order**: ### Check 1: MCP Server (Best experience) ```bash mcp-cli tools | grep excalidraw ``` If you see tools like `excalidraw/batch_create_elements` → **use MCP mode**. Call MCP tools directly. ### Check 2: REST API (Fallback — works without MCP server) ```bash curl -s http://localhost:3000/health ``` If you get `{"status":"ok"}` → **use REST API mode**.

## Workflow: Share Diagram (excalidraw.com URL) 1.

references/cheatsheet.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/cheatsheet.md Description: # Excalidraw Skill Cheatsheet ## Defaults - Canvas base URL: `EXPRESS_SERVER_URL` (default `http://localhost:3000`) - Canvas health: `GET /health` ## MCP Tools (26 total) ### Element CRUD | Tool | Description | Required params | |------|-------------|-----------------| | `create_element` | Create shape/text/arrow/line | `type`, `x`, `y` | | `get_element` | Get single element by ID | `id` | | `update_element` | Update element properties | `id` | | `dele

scripts/export-elements.cjsHIGH
78.3%

Malicious tool definition detected

Tool: scripts/export-elements.cjs Description: #!/usr/bin/env node /* eslint-disable no-console */ const fs = require("node:fs"); const path = require("node:path"); const DEFAULT_URL = process.env.EXPRESS_SERVER_URL || "http://localhost:3000"; function parseArgs(argv) { const out = { url: DEFAULT_URL, outFile: null }; for (let i = 0; i < argv.length; i++) { const a = argv[i]; if (a === "--url") out.url = argv[++i]; else if (a === "--out") out.outFile = argv[++i]; else if (a === "-o") out.outFile

scripts/healthcheck.cjsHIGH
78.3%

Malicious tool definition detected

throw new Error("This script requires Node 18+ (global fetch)."); } const { url } = parseArgs(process.argv.slice(2)); const res = await fetch(`${url.replace(/\/$/, "")}/health`); const text = await res.text(); if (!res.ok) { console.error(text); process.exit(1); } console.log(text); } main().catch((err) => { console.error(err?.stack || String(err)); process.exit(1); });

scripts/import-elements.cjsMEDIUM
58.9%

Tool passed security scan

scripts/update-element.cjsMEDIUM
57.9%

Tool passed security scan

scripts/clear-canvas.cjsMEDIUM
53.6%

Tool passed security scan

scripts/create-element.cjsMEDIUM
52.8%

Tool passed security scan

scripts/delete-element.cjsMEDIUM
44.3%

Tool passed security scan

Audit Metadata
Max File Score
90%
Classification
UNKNOWN_SERVER
Files Scanned
9
Files Flagged
9
Chunks Analyzed
11
Analyzed
Feb 22, 2026, 06:06 AM
Security Audit — runlayer — excalidraw-skill