excalidraw-skill
Audited by Runlayer on Feb 22, 2026
Malicious tool definition detected
--- # Excalidraw Skill ## Step 0: Detect Connection Mode Before doing anything, determine which mode is available. Run these checks **in order**: ### Check 1: MCP Server (Best experience) ```bash mcp-cli tools | grep excalidraw ``` If you see tools like `excalidraw/batch_create_elements` → **use MCP mode**. Call MCP tools directly. ### Check 2: REST API (Fallback — works without MCP server) ```bash curl -s http://localhost:3000/health ``` If you get `{"status":"ok"}` → **use REST API mode**.
## Workflow: Share Diagram (excalidraw.com URL) 1.
Malicious tool definition detected
Tool: references/cheatsheet.md Description: # Excalidraw Skill Cheatsheet ## Defaults - Canvas base URL: `EXPRESS_SERVER_URL` (default `http://localhost:3000`) - Canvas health: `GET /health` ## MCP Tools (26 total) ### Element CRUD | Tool | Description | Required params | |------|-------------|-----------------| | `create_element` | Create shape/text/arrow/line | `type`, `x`, `y` | | `get_element` | Get single element by ID | `id` | | `update_element` | Update element properties | `id` | | `dele
Malicious tool definition detected
Tool: scripts/export-elements.cjs Description: #!/usr/bin/env node /* eslint-disable no-console */ const fs = require("node:fs"); const path = require("node:path"); const DEFAULT_URL = process.env.EXPRESS_SERVER_URL || "http://localhost:3000"; function parseArgs(argv) { const out = { url: DEFAULT_URL, outFile: null }; for (let i = 0; i < argv.length; i++) { const a = argv[i]; if (a === "--url") out.url = argv[++i]; else if (a === "--out") out.outFile = argv[++i]; else if (a === "-o") out.outFile
Malicious tool definition detected
throw new Error("This script requires Node 18+ (global fetch)."); } const { url } = parseArgs(process.argv.slice(2)); const res = await fetch(`${url.replace(/\/$/, "")}/health`); const text = await res.text(); if (!res.ok) { console.error(text); process.exit(1); } console.log(text); } main().catch((err) => { console.error(err?.stack || String(err)); process.exit(1); });
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan