Scan Report
5 /100
excalidraw-diagram
Generate Excalidraw hand-drawn diagrams from natural language. Outputs .excalidraw JSON files and optionally exports to PNG via Playwright.
The excalidraw-diagram skill is a straightforward diagram-generation tool with no malicious behavior. All capabilities (filesystem write, network read, shell via Playwright) are declared in SKILL.md. The Python script is transparent: it reads a JSON file, renders it via a local HTML+Playwright pipeline, and writes a PNG output.
Safe to install
This skill is safe to use. No action required.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | WRITE | WRITE | ✓ Aligned | SKILL.md Step 4: writes .excalidraw files to cwd or user-specified path |
| Network | READ | READ | ✓ Aligned | SKILL.md Step 4.5: 需要联网 (CDN resources); export-png.py fetches unpkg.com for Rea… |
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md Step 4.5: python3 ~/.openclaw/.../export-png.py — launches Playwright h… |
| Environment | NONE | NONE | — | No environment variable access in any file |
| Skill Invoke | NONE | NONE | — | No cross-skill invocation detected |
| Clipboard | NONE | NONE | — | No clipboard access detected |
| Browser | READ | READ | ✓ Aligned | SKILL.md Step 4.5: Playwright headless Chromium — declared as required dependenc… |
| Database | NONE | NONE | — | No database access |
2 findings
Medium External URL 外部 URL
https://excalidraw.com README.md:7 Medium External URL 外部 URL
http://127.0.0.1: scripts/export-png.py:131 File Tree
7 files · 37.6 KB · 1253 lines Markdown 6f · 1080L
Python 1f · 173L
├─
▾
references
│ ├─
diagram-templates.md
Markdown
│ ├─
element-spec.md
Markdown
│ ├─
examples.md
Markdown
│ └─
headless-export.md
Markdown
├─
▾
scripts
│ └─
export-png.py
Python
├─
README.md
Markdown
└─
SKILL.md
Markdown
Dependencies 2 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
playwright | * | pip | No | Required for headless Chromium PNG export. Not pinned but widely-used, standard tooling. |
react@18 (CDN) | 0.17.6 of @excalidraw/excalidraw | unpkg.com CDN | No | Loaded from unpkg CDN in the headless render HTML; fully offline option is to use excalidraw.com import method |
Security Positives
✓ All declared capabilities match actual code — no hidden functionality
✓ No credential harvesting or sensitive path access (~/.ssh, ~/.aws, .env)
✓ No data exfiltration — the pipeline is purely local (read JSON → render → write PNG)
✓ Local HTTP server is bound to 127.0.0.1 only, not exposed externally
✓ No base64 decoding, eval(), or obfuscated code
✓ No remote script execution (curl|bash, wget|sh) or unsigned pip installs
✓ HTML injection is contained: JSON is embedded via json.dumps (not innerHTML eval), and the page is served locally on a random port
✓ Dependencies (playwright, React, Excalidraw) are standard, open-source libraries loaded from a reputable CDN
✓ Clean file tree with no binary payloads or suspicious assets