Atlas / Skills / tldraw / Review Docs

Review DocsBLOCK

skills/tldraw/review-docs

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
—
License
NOASSERTION
Stars
51,011
01

Overview

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Read from source at commit d368467d4f85OBSERVED · 2026-10-20
Advertisement
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: review-docs
description: Review and improve tldraw SDK documentation against the voice and docs guides, scoring each article and iterating until it passes. Use when asked to review docs, audit an article in apps/docs/content, check whether documentation follows the style guide, or improve existing documentation.
---

# Review documentation

This skill runs an evaluation and improvement loop on a documentation file.

**Target**: $ARGUMENTS

**Relevant skills**: `write-docs`

## Workflow overview

```
┌──────────────────────────────────────────────────────────────┐
│  INITIALIZE: Create state file to track issues               │
└──────────────────────────────────────────────────────────────┘
                              ↓
┌──────────────────────────────────────────────────────────────┐
│  EVALUATE (parallel)                                         │
│  ┌─────────────────────┐    ┌─────────────────────────────┐  │
│  │ Style Agent         │    │ Content Agent               │  │
│  │ (readability+voice) │    │ (completeness+accuracy)     │  │
│  └─────────────────────┘    └─────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘
                              ↓
┌──────────────────────────────────────────────────────────────┐
│  UPDATE STATE: Add new issues, verify fixed issues           │
└──────────────────────────────────────────────────────────────┘
                              ↓
┌──────────────────────────────────────────────────────────────┐
│  SUMMARIZE: Present findings, ask user for next step         │
└──────────────────────────────────────────────────────────────┘
                              ↓
           ┌──────────────────┼──────────────────┐
           ↓                  ↓                  ↓
    [User: improve]   [User: complete]    [User: done]
           ↓                  ↓                  ↓
┌──────────────────┐  ┌──────────────────┐    EXIT
│  IMPROVE         │  │  COMPLETE        │
│  (fix issues)    │  │  (fix all, exit) │
└──────────────────┘  └──────────────────┘
           ↓                  ↓
  LOOP → EVALUATE          EXIT
```

## State file

Create a state file in the scratchpad directory to track all issues across rounds. This prevents re-discovering the same issues and allows verification of fixes.

**Path**: `<scratchpad>/review-<filename>.md`

**Format**:

```markdown
# Review tracker: [filename]

## Issue tracker

Status values: `pending` | `fixed` | `verified-fixed` | `not-fixed` | `wont-fix`

| ID  | Issue         | Type                        | Status         | Round | Notes            |
| --- | ------------- | --------------------------- | -------------- | ----- | ---------------- |
| 1   | [description] | Style/Accuracy/Completeness | pending        | 1     | [details]        |
| 2   | [description] | Accuracy                    | verified-fixed | 1     | Fixed in round 1 |
| 3   | [description] | Completeness                | wont-fix       | 2     | Out of scope     |

## Round history

### Round 1

- Style: X/10, Voice: X/10, Completeness: X/10, Accuracy: X/10
- **Total: X/40**
```

**Status definitions**:

- `pending`: Issue discovered, not yet addressed
- `fixed`: Improvement agent claims to have fixed it, needs verification
- `verified-fixed`: Evaluation confirmed the fix was applied correctly
- `not-fixed`: Evaluation found the fix wasn't applied correctly
- `wont-fix`: False alarm, out of scope, or intentional (e.g., completeness issues that require documentation expansion)

## Step 1: Initial evaluation

For the **first round**, launch two subagents **in parallel** using the Task tool:

```
// Single message with two Task tool calls:
Task(subagent_type="general-purpose", model="opus", prompt="Style evaluation...")
Task(subagent_type="general-purpose", model="opus", prompt="Content evaluation...")
```

### Style agent prompt (round 1)

```
Evaluate documentation style for: $ARGUMENTS

Read the shared guides relative to this skill directory, then read the target document:
1. `../../VOICE.md`
2. `../shared/docs-guide.md`
3. $ARGUMENTS

Score these dimensions (0-10):

READABILITY - How clear and easy to understand is the writing?
- Clear, direct sentences
- Logical flow between sections
- Appropriate use of code snippets and links
- No unnecessary jargon

VOICE - How well does it follow the writing guide?
- Confident assertions (no hedging)
- Active voice, present tense
- No AI writing tells (hollow importance, trailing gerunds, formulaic transitions)
- Appropriate tone (expert-to-developer)
- Sentence case headings

Important! Include as many high-priority fixes as needed.

Return in this exact format:

STYLE REPORT: [filename]

READABILITY: [score]/10
- [specific issue or strength]
- [specific issue or strength]

VOICE: [score]/10
- [specific issue or strength]
- [specific issue or strength]

PRIORITY FIXES:
1. [Most important style issue]
2. [Second most important]
3. [Third most important]
4. ...
```

### Content agent prompt (round 1)

```
Evaluate documentation content for: $ARGUMENTS

Read $ARGUMENTS, then verify claims against the source code in packages/editor/ and packages/tldraw/.

Score these dimensions (0-10):

COMPLETENESS - How thorough is the coverage?
- Overview establishes purpose before mechanism
- Key concepts explained with enough depth
- Illustrative code snippets where needed
- Links to relevant examples in apps/examples (if applicable)

ACCURACY - Is the technical content correct?
- Code snippets are syntactically correct and use valid APIs
- API references match actual implementation
- Described behavior matches the code
- No outdated information

For accuracy issues, include file:line references to the source code.

Important! Include as many high-priority fixes as needed. Make sure that all accuracy issues are flagged.

Return in this exact format:

CONTENT REPORT: [filename]

COMPLETENESS: [score]/10
- [specific issue or strength]
- [specific issue or strength]

ACCURAC
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)WARN
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
UNDECLARED (1 observation(s))
Shell
UNDECLARED (1 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (17)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/scripts/license-report.ts:149
const output = await exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.agents/skills
.agents/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills
.claude/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills
.cursor/skills
Why it matters. link not followed
MEDIUMNetwork egress · net.client · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.ts:341
fetch(url.toString()).catch(noop)
MEDIUMPrompt injection · scope.undeclared_network · CWE-94, CWE-1427
<declared scope>
network use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare network use in the description, or remove it
MEDIUMPrompt injection · scope.undeclared_shell · CWE-94, CWE-1427
<declared scope>
shell use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare shell use in the description, or remove it
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.test.ts:3
import { publishDates } from '../../version'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.test.ts:14
vi.mock('../../version', () => {
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.ts:3
import { publishDates, version } from '../../version'
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:94
const origins = ['http://example.com', 'https://localhost:3000', 'https://127.0.0.1']
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:614
['http://127.0.0.1:3000/', true],
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:617
['http://192.168.1.5:3000/', true],
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.test.ts:1156
const binaryDerString = atob(pemContents)
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:362
new Uint8Array(str2ab(atob(signature))),
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:363
new Uint8Array(str2ab(atob(encodedData)))
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:376
decodedData = JSON.parse(atob(encodedData))

Gates applied: no_behavioural_pass.

Audited 2026-10-20 · audit v0.4.1 · source sha d368467d4f85full audit observations/trust-audit/skill/tldraw__review-docs.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-20d368467d4f85BLOCKD69first audit
05

Questions

What does the review-docs — tldraw/tldraw skill do?

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Is review-docs — tldraw/tldraw safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What can review-docs — tldraw/tldraw access on my machine?

The audit observed that it reaches the network, runs shell commands and reads or writes files. At least one of those is not mentioned in its own description, which is itself a finding. Secrets in the source: none found.

How current is this page?

The grade is for one exact copy of the source (d368467d4f85), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Add this badge to your README

Shows this page's audit result and links back to it. It updates when the audit does.

ModelsAtlas audit badge

Markdown
[![ModelsAtlas audit: Review Docs](https://modelsatlas.com/skills/tldraw/review-docs/badge.svg)](https://modelsatlas.com/skills/tldraw/review-docs/)

Not your listing, or something out of date? Claim or update your listing.

Advertisement