SkillTriage
io.github.tldraw/tldraw MCP server
github:tldraw/tldraw
Review
Capabilities a person should look at before installing.
Why
- Contains wording that tries to override the AI agent's instructions. in
skills/dotcom-release-crew/SKILL.md - Contains invisible or obfuscated characters. in
skills/dotcom-release-crew/SKILL.md - Installs packages from outside the sanctioned set. in
skills/pr-walkthrough/SKILL.md - Contains instructions placed where the agent reads them indirectly. in
skills/tldraw-migrate/SKILL.md - Contains invisible or obfuscated characters. in
apps/examples/e2e/tests/export-snapshots.spec.tsx - Changes AI rules or configuration files. in
templates/agent/worker/prompt/sections/rules-section.ts - Contains instructions placed where the agent reads them indirectly. in
apps/docs/content/docs/assets.mdx - Starts other processes and makes network requests. in
apps/mcp-app/src/wrangler-dev-harness.ts - Starts other processes and makes network requests. in
internal/scripts/cloudflare/dns-check.ts - Starts other processes and makes network requests. in
internal/scripts/cloudflare/ssl-cleanup.ts - Installs or updates packages at runtime by running a package manager. in
internal/scripts/lib/publishing.ts - Starts other processes and makes network requests. in
internal/scripts/process-compose-bin.cjs - Runs an install script when installed. in
package.json - Starts other processes and makes network requests. in
skills/pr-walkthrough/scripts/generate-audio.sh
GitHub archives have no registry checksum; the result is tied to the commit shown.
Automated static analysis by MoorAI's open-source engine. A verdict describes what the package's code can do, not the intent of its authors. Report a mistake →