Atlas / Skills / tldraw / Write Pr

Write PrBLOCK

skills/tldraw/write-pr

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Verdict
BLOCK
Grade
D
Trust score
62 /100
Version
—
Hosts
1 documented
License
NOASSERTION
Stars
51,110
01

Overview

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Read from source at commit db5ef92c53daOBSERVED · 2026-10-27
Advertisement
02

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
cursormentioned
03

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: write-pr
description: Reference standards for writing pull request titles and descriptions in the tldraw repository, plus the pre-flight comment sweep over the diff. Use as supporting guidance when another skill or workflow needs PR content standards, not as the user-facing create/update PR workflow.
---

# Writing pull requests

Standards for PR titles and descriptions in tldraw/tldraw.

## Write for the reviewer (read this first)

This is the governing rule; everything below serves it. Write the description for a reviewer who knows the codebase architecture but has **not** read your code or the diff. Their time is the scarce resource. The description's job is to give them the framing they can't get from the code, then get out of the way.

**Default to short.** A few sentences of framing is the norm, not the exception. Match length to the change: a one-line fix needs a sentence; a new system needs the fuller treatment. A description that looks long and structured is not more valuable — often it's less, because it buries the framing under scaffolding. If a reviewer would need their own AI to interpret yours, it has failed.

**Order it coarse to granular.** Structure the description as an inverted pyramid, most important first. A reader should be able to stop at any point and leave with a correct, coherent understanding: a skimmer gets the goal and motivation from the opening lines; someone weighing the approach reads into the design and decisions; a close reviewer continues to the specifics. Never make someone read to the end to find out what the PR is for.

Cover the following, roughly in this order — each layer more detailed than the last, and each optional once the change no longer warrants it:

- **Goal, motivation, and use case.** Why this change, why now, what it's for. What was wrong or missing before. This comes first, always.
- **The higher-level change.** The shape of the solution — behavior and structure, not a line-by-line restatement of the diff.
- **API design and decisions.** New or changed public surface, the approach you picked, what you ruled out and why, and anything you're unsure about. A decision you don't surface is one the reviewer can't catch.
- **Example snippets and fine detail.** For anything touching an API, data shape, or usage pattern, a few lines of before/after say more than a paragraph. Keep them minimal.

**Do not:**

- Restate the diff. No file-by-file walkthrough, no narrating what a function does, no describing *how* the code works step by step. Reviewers can read code.
- Generate tables or lists that mirror the code — a `Method | Description` table that just re-says the signatures, an inventory of every changed file, a term glossary of self-explanatory names.
- Pad with ceremony. Structure that exists to look thorough is noise.

**Never invent the *why*.** The motivation and trade-offs must come from real intent — the commits, the linked issue, or the author. If you don't know why a change was made or what was considered, **ask the user; do not guess.** A confident but fabricated rationale is worse than useless: it's misleading, and it's the thing reviewers most need to trust.

## PR title

Use semantic PR titles (Conventional Commits format):

```
<type>(<scope>): <description>
```

### Types

- `feat` - New feature
- `fix` - Bug fix
- `docs` - Documentation only
- `refactor` - Code change that neither fixes a bug nor adds a feature
- `perf` - Performance improvement
- `test` - Adding or fixing tests
- `chore` - Maintenance tasks

### Scope (optional)

A noun describing the affected area: `fix(editor):`, `feat(sync):`, `docs(examples):`

### Examples

- `feat(editor): add snap threshold configuration option`
- `fix(arrows): correct binding behavior with rotated shapes`
- `docs: update sync documentation`
- `refactor(store): simplify migration system`

## PR body

Bug fix and improvement PRs (`bugfix` and `improvement` change types) use the before/after template below. Everything else uses this one:

```md
<description paragraph>

### Change type

- [x] `bugfix` | `improvement` | `feature` | `api` | `other`

### Test plan

1. Step to test...
2. Another step...

- [ ] Unit tests
- [ ] End to end tests

### Release notes

- Brief description of changes for users
```

### Description paragraph

Start with: "In order to X, this PR does Y." Follow the reviewer-first rules at the top of this skill.

- X is the **concrete situation that made this work necessary** — the real thing someone was trying to do — not a restatement of what Y does. "In order to let apps carry undo history across editor rebuilds, this adds an API to carry undo history across editor rebuilds" is circular: X just renames Y. Push X up a level to the actual goal, e.g. "so desktop can reload the editor without losing the user's place, the way HMR preserves component state across a code edit."
- Name the real driving case, not a hypothetical. If you're inventing example scenarios to illustrate the why ("e.g. if someone toggled a plugin..."), you're reverse-engineering a justification from the finished code — you haven't written down the case that actually prompted it. Work forward from that case instead.
- Beware abstract mechanism as a stand-in for motivation. A true technical fact about the SDK ("editor config is fixed at construction time") explains a constraint, not why anyone cares. Keep going until a reader can picture the specific thing that stopped working or became possible.
- Keep it specific - avoid vague phrases like "improve user experience"
- Link related issues in the first paragraph
- Don't expect readers to also read the linked issue

### Bug fix and improvement PRs

Bug fix and improvement PRs use a fixed shape instead of the description paragraph. The same reviewer-first rules apply; the structure exists so a reviewer can see what was wrong (or lacking), what it does now, and why, without reading the diff.

```md
This PR fixes a bug where <symptom a user or dev
04

Trust audit

BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (2 observation(s))
Network
declared (1 observation(s))
Shell
UNDECLARED (3 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (17)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/scripts/license-report.ts:149
const output = await exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
scripts/record-interaction.mjs:98
editor: (fn, arg) => page.evaluate(([src, arg]) => new Function('editor', 'arg', `return (${src})(editor, arg)`)(window.editor, arg), [fn.toString(), arg]),
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.os_system · CWE-78, CWE-94, CWE-95
scripts/record-interaction.mjs:128
const ffmpeg = spawnSync(
Why it matters. a shell string executor
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.agents/skills
.agents/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills
.claude/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills
.cursor/skills
Why it matters. link not followed
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.test.ts:3
import { publishDates } from '../../version'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.test.ts:14
vi.mock('../../version', () => {
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.ts:3
import { publishDates, version } from '../../version'
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:94
const origins = ['http://example.com', 'https://localhost:3000', 'https://127.0.0.1']
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:614
['http://127.0.0.1:3000/', true],
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:617
['http://192.168.1.5:3000/', true],
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.test.ts:1156
const binaryDerString = atob(pemContents)
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:362
new Uint8Array(str2ab(atob(signature))),
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:363
new Uint8Array(str2ab(atob(encodedData)))
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:376
decodedData = JSON.parse(atob(encodedData))
INFOPrompt injection · scope.undeclared_shell · CWE-94, CWE-1427
<declared scope>
shell use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare shell use in the description, or remove it

Gates applied: no_behavioural_pass.

Audited 2026-10-27 · audit v0.4.1 · source sha db5ef92c53dafull audit observations/trust-audit/skill/tldraw__write-pr.json · Report an issue / request a re-scan
05

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-27db5ef92c53daBLOCKD62first audit
06

Questions

What does the write-pr — tldraw/tldraw skill do?

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Is write-pr — tldraw/tldraw safe to install?

No — not without reading the findings first. The audit graded it D (62/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What can write-pr — tldraw/tldraw access on my machine?

The audit observed that it reaches the network, runs shell commands and reads or writes files. At least one of those is not mentioned in its own description, which is itself a finding. Secrets in the source: none found.

Which assistants does write-pr — tldraw/tldraw work with?

Its documentation mentions cursor. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (db5ef92c53da), read on 2026-10-27. The repository is watched, and a new audit runs when it changes — this is the first audit.

Add this badge to your README

Shows this page's audit result and links back to it. It updates when the audit does.

ModelsAtlas audit badge

Markdown
[![ModelsAtlas audit: Write Pr](https://modelsatlas.com/skills/tldraw/write-pr/badge.svg)](https://modelsatlas.com/skills/tldraw/write-pr/)

Not your listing, or something out of date? Claim or update your listing.

Advertisement