registry / excalidrop / 0.2.12
excalidrop@0.2.12
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed credential flow supports the package’s stated GitHub-backed canvas and relay features. Although a GitHub token is sent to the package’s default relay for RPC authorization, the reviewed source ties those requests to canvas operations and shows repository access checks rather than unrelated collection.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The MCP server may preload the selected canvas at startup; relay RPCs occur when a user requests supported operations such as screenshots or viewport changes.
Impact
The relay is part of the package’s remote-canvas workflow; the reviewed code shows repository access checks and no token persistence in the relay.
Mechanism
The server reads a GitHub token for GitHub API calls and sends it as a bearer token to the configured Excalidrop relay for RPC authorization and forwarding.
AI rationale
The reviewed credential flow supports the package’s stated GitHub-backed canvas and relay features. Although a GitHub token is sent to the package’s default relay for RPC authorization, the reviewed source ties those requests to canvas operations and shows repository access checks rather than unrelated collection.
Evidence
~/.config/excalidrop/gh_token.excalidrop.json${os.tmpdir()}/excalidrop-mcp.logGitHub repository canvas.excalidraw on the excalidrop branch
Network endpoints4
api.github.com/repos/{repo}excalidrop.wtf403.workers.dev/rpc/{repo}/{method}github.com/login/device/codegithub.com/login/oauth/access_token
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s prepare and prepublishOnly scripts run builds; it declares no install or postinstall hook.
- The MCP server gets GitHub credentials from GITHUB_TOKEN, gh auth, or its stored device-flow token.
- The relay receives the GitHub bearer token for RPC requests, including repo and method in the request URL.
- The screenshot helper calls the relay for a screenshot operation; the request is tied to an MCP tool call.
- The relay checks repository access with the token and documents that tokens are not persisted; its cache key hashes the token.
- The README documents the default relay URL and the GitHub token setting.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/frontend/assets/index-Dtc2YcdT.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-Dtc2YcdT.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-Dtc2YcdT.js
dist/frontend/assets/index-Dtc2YcdT.jsView on unpkg · L41dist/mcp.jsView file
7process.env.NO_COLOR = '1';
L8: import { execSync } from 'node:child_process';
L9: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-Dtc2YcdT.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-D_hAUGHx.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-Dtc2YcdT.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.12.
See all versions of excalidrop for other recorded verdicts.
- Review the evidence and your use of excalidrop@0.2.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.