registry / excalidrop / 0.2.8
excalidrop@0.2.8
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged command execution and network access support the remote GitHub-backed canvas and its screenshot relay; the skill helper sends its token to GitHub's API. The default relay receives the GitHub token for user-requested screenshot or viewport operations, and the bundled worker verifies repository access without persisting the token.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The relay is called when a user requests a screenshot or viewport operation; relay use is enabled by default and can be disabled.
Impact
No unauthorized impact identified from the reviewed code. The token is disclosed to the relay during those operations, which is part of the documented remote-canvas design.
Mechanism
The MCP server forwards a GitHub bearer token to the configured relay. The bundled worker checks access to the selected repository with GitHub and states that tokens are not persisted.
AI rationale
The flagged command execution and network access support the remote GitHub-backed canvas and its screenshot relay; the skill helper sends its token to GitHub's API. The default relay receives the GitHub token for user-requested screenshot or viewport operations, and the bundled worker verifies repository access without persisting the token.
Evidence
package.jsondist/mcp.jsworker/src/relay.jsREADME.mdskills/excalidraw-skill/scripts/gh-helper.cjs
Network endpoints3
api.github.comexcalidrop.wtf403.workers.devjson.excalidraw.com
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The prepare and prepublishOnly scripts run the package build; no install hook behavior that sends data is shown.
- The MCP relay is used for screenshot and viewport requests, and can be disabled with a flag or environment variable.
- Relay requests forward a GitHub token to the configured relay; the bundled worker uses it to verify access to the selected repository and says it does not persist tokens.
- The skill helper sends its GitHub token in requests to api.github.com.
Evidence against
- The default relay is operated at excalidrop.wtf403.workers.dev, so screenshot and viewport calls send the user's GitHub bearer token to that service.
- The README documents the relay's default host and offers a setting to disable it, but does not explicitly describe forwarding the token.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggeddist/frontend/assets/index-BQuFwudZ.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-BQuFwudZ.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-BQuFwudZ.js
dist/frontend/assets/index-BQuFwudZ.jsView on unpkg · L41dist/mcp.jsView file
5process.env.NO_COLOR = '1';
L6: import { execSync } from 'node:child_process';
L7: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-BQuFwudZ.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-DE1yOycD.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-BQuFwudZ.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.8.
See all versions of excalidrop for other recorded verdicts.
- Review the evidence and your use of excalidrop@0.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.