Atlas / Skills / tldraw / Write Docs

Write DocsBLOCK

skills/tldraw/write-docs

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
—
License
NOASSERTION
Stars
51,027
01

Overview

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Read from source at commit d368467d4f85OBSERVED · 2026-10-22
Advertisement
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: write-docs
description: Writing SDK documentation for tldraw. Use when creating new documentation articles, updating existing docs, or when documentation writing guidance is needed. Applies to docs in apps/docs/content/.
---

# Write documentation

This skill covers how to write and update tldraw SDK documentation.

## Location

All documentation lives in `apps/docs/content/`. The main categories are:

| Directory          | Purpose                                       |
| ------------------ | --------------------------------------------- |
| `docs/`            | SDK documentation articles                    |
| `releases/`        | Release notes (see write-release-notes skill) |
| `examples/`        | Example documentation                         |
| `getting-started/` | Quickstart and setup guides                   |

## Process

### 1. Understand the scope

Before writing:

- Identify the target audience (new users, experienced developers, API reference)
- Check existing docs that cover related topics
- Look at relevant examples in `apps/examples/`
- Read the API types and comments in the source code

### 2. Create the file

Create a new `.mdx` file in the appropriate directory with frontmatter:

```yaml
---
title: Feature name
status: published
author: steveruizok
date: 3/22/2023
order: 1
keywords:
  - keyword1
  - keyword2
---
```

### 3. Write the content

Follow the structure:

1. **Overview** — 1-2 paragraphs on what and why
2. **Basic usage** — The simplest working example
3. **Details** — Deeper explanation with more examples
4. **Edge cases** — Advanced patterns, gotchas
5. **Links** — Related docs and examples

### 4. Use MDX components

#### API links

Use `[ClassName](?)` or `[ClassName#methodName](?)` for API references:

```markdown
The [Editor](?) class has many methods. Use [Editor#createShapes](?) to create shapes.
```

#### Code highlighting

Use `<FocusLines>` to highlight specific lines:

```markdown
<FocusLines lines={[2,6,10]}>

\`\`\`tsx
import { Tldraw } from 'tldraw'
import { useSyncDemo } from '@tldraw/sync'
\`\`\`

</FocusLines>
```

#### Images

```markdown
<Image
	src="/images/api/events.png"
	alt="A diagram showing an event being sent to the editor."
	title="Caption text here."
/>
```

#### Tables for API documentation

Use tables for listing methods, options, or properties:

```markdown
| Method                   | Description                                    |
| ------------------------ | ---------------------------------------------- |
| [Editor#screenToPage](?) | Convert a point in screen space to page space. |
| [Editor#pageToScreen](?) | Convert a point in page space to screen space. |
```

```markdown
| Value     | Description                                          |
| --------- | ---------------------------------------------------- |
| `default` | Sets the initial zoom to 100%.                       |
| `fit-x`   | The x axis will completely fill the viewport bounds. |
```

### 5. Verify

Check that:

- Code examples actually work
- API links resolve correctly
- Images have alt text
- Headings use sentence case
- No AI tells (see style guide)

## References

- **Style guide**: See `../shared/docs-guide.md` for voice, tone, and formatting conventions.
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (1 observation(s))
Shell
UNDECLARED (1 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (15)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/scripts/license-report.ts:149
const output = await exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.agents/skills
.agents/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills
.claude/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills
.cursor/skills
Why it matters. link not followed
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.test.ts:3
import { publishDates } from '../../version'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.test.ts:14
vi.mock('../../version', () => {
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.ts:3
import { publishDates, version } from '../../version'
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:94
const origins = ['http://example.com', 'https://localhost:3000', 'https://127.0.0.1']
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:614
['http://127.0.0.1:3000/', true],
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:617
['http://192.168.1.5:3000/', true],
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.test.ts:1156
const binaryDerString = atob(pemContents)
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:362
new Uint8Array(str2ab(atob(signature))),
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:363
new Uint8Array(str2ab(atob(encodedData)))
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:376
decodedData = JSON.parse(atob(encodedData))
INFOPrompt injection · scope.undeclared_shell · CWE-94, CWE-1427
<declared scope>
shell use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare shell use in the description, or remove it

Gates applied: no_behavioural_pass.

Audited 2026-10-22 · audit v0.4.1 · source sha d368467d4f85full audit observations/trust-audit/skill/tldraw__write-docs.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-22d368467d4f85BLOCKD69first audit
05

Questions

What does the write-docs — tldraw/tldraw skill do?

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Is write-docs — tldraw/tldraw safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What can write-docs — tldraw/tldraw access on my machine?

The audit observed that it reaches the network, runs shell commands and reads or writes files. At least one of those is not mentioned in its own description, which is itself a finding. Secrets in the source: none found.

How current is this page?

The grade is for one exact copy of the source (d368467d4f85), read on 2026-10-22. The repository is watched, and a new audit runs when it changes — this is the first audit.

Add this badge to your README

Shows this page's audit result and links back to it. It updates when the audit does.

ModelsAtlas audit badge

Markdown
[![ModelsAtlas audit: Write Docs](https://modelsatlas.com/skills/tldraw/write-docs/badge.svg)](https://modelsatlas.com/skills/tldraw/write-docs/)

Not your listing, or something out of date? Claim or update your listing.

Advertisement