Is Excalidraw File Manager safe?
We analyzed Excalidraw File Manager version 1.0.4's actual code and gave it a 86/100 trust score. This appears to be a purpose-aligned Excalidraw file…
Bottom line
This appears to be a purpose-aligned Excalidraw file manager with moderate access and no demonstrated abuse.
What it can access
It can read and restore Excalidraw drawings, change that site’s page, and save snapshots locally, which fits its stated purpose but may expose private work.[Q1][Q2][Q5]
Security weaknesses
The extension acts automatically when Excalidraw loads and includes a large bundled interface, but no concrete dangerous weakness was found.[Q8][Q10][Q21]
Signs of misuse
There is no evidence of tracking, outside sharing, credential collection, remote commands, or downloaded code execution.[Q6][Q7][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can script excalidraw.com, access the currently authorized active tab, and retain data in extension-local storage; it has no all-sites permission.
Runs a content script only on https://excalidraw.com/* and requests activeTab, scripting, storage, and only the excalidraw.com host. — manifest.json:16-33
Reads and writes Excalidraw's local drawing state and adds an extension-owned file-name label. — assets/content-main.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It changes Excalidraw by restoring drawing data from a saved snapshot, reloading the page, and adding a current-file label to the menu.
PUSH_EXCALIDRAW_FILE replaces localStorage.excalidraw and reloads the page; PUSH_CURRENT_WORKING_FILE_NAME creates or updates a .file-name-div in .App-menu. — assets/content-main.js:1
Uses chrome.scripting.executeScript after a completed tab update to add the same file-name label when permission allows. — assets/background.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Only reads the Excalidraw localStorage drawing value and its own .file-name-div; it does not query forms or inputs. — assets/content-main.js:1
The injected function only creates a text label in .App-menu. — assets/background.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests activeTab, scripting, storage, and the Excalidraw host, but not cookies. — manifest.json:32-33
Accesses localStorage.excalidraw only; it does not read document.cookie or authentication state. — assets/content-main.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads potentially private Excalidraw drawing JSON and stores named snapshots locally in the browser profile.
LOAD_EXCALIDRAW_FILE returns window.localStorage.getItem('excalidraw') to the extension popup. — assets/content-main.js:1
Stores drawing snapshots, file names, collections, timestamps, and the selected file ID in chrome.storage.local. — assets/popup.js:105
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
First-party file-management logic uses chrome.storage.local and chrome.tabs messaging; it defines no application network endpoint or telemetry client. — assets/popup.js:1-105
The page-side operations are limited to localStorage, DOM label updates, reload, and internal runtime replies. — assets/content-main.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The sole fetch is Vite's standard module-preload helper for local packaged links; no product API call exists. — assets/popup.js:1
Contains only a tab-update listener and a fixed packaged injection function. — assets/background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Its page access runs automatically on Excalidraw, and the background worker attempts to add a fixed label after tabs finish loading.
Registers the Excalidraw content script and background service worker. — manifest.json:16-24
Listens for completed tab updates and invokes a fixed script that adds the current-file prompt; browser host permissions constrain where it can succeed. — assets/background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no chrome_url_overrides, chrome_settings_overrides, proxy, privacy, management, debugger, or search-provider capability. — manifest.json:1-34
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The security-relevant first-party scripts are tiny, but the popup's React and UI dependencies are bundled into a large minified file and stylesheet.
Records roughly 1.03 MB unpacked, dominated by a 327 KB minified popup script and a 691 KB stylesheet. — inventory.json:1
Combines React, Redux, Radix UI, and the small first-party file manager into a minified bundle. — assets/popup.js:1-105
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Package search found no eval or Function constructor; the Function.toString reference belongs to a library type check and does not execute text. — assets/popup.js:1-105
chrome.scripting.executeScript receives a fixed packaged function, not a string or remote response. — assets/background.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
OPEN_POPUP tests window.location.href only for the fixed https://excalidraw.com/ prefix and returns a boolean. — assets/content-main.js:1
Stores files, collections, and a current-file ID, not browsing history or URLs. — assets/popup.js:105
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Creates UUIDs for local file and collection records stored in chrome.storage.local. — assets/popup.js:105
No analytics, advertising, account, or remote identifier endpoint is present. — assets/popup.js:1-105
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Returns the Excalidraw drawing JSON only through internal extension messaging. — assets/content-main.js:1
Persists the returned JSON with chrome.storage.local; no external request is made with it. — assets/popup.js:105
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests none of the clipboard, capture, media, or native-messaging permissions. — manifest.json:32-33
Contains no keyboard, input, clipboard, media-capture, screenshot, or canvas-export listener. — assets/content-main.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares neither externally_connectable nor nativeMessaging. — manifest.json:1-34
Listens only for internal chrome.runtime messages and implements five fixed file-management operations. — assets/content-main.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The only injected UI is a fixed current-file prompt label. — assets/background.js:1
Page changes are limited to that label and user-selected Excalidraw drawing restoration. — assets/content-main.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no webRequest or declarativeNetRequest permission or ruleset. — manifest.json:1-34
Contains no first-party request filtering or redirect logic. — assets/popup.js:1-105
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
The only persistent host access is https://excalidraw.com/. — manifest.json:16-33
Does not request nativeMessaging or file:// host patterns. — manifest.json:32-33
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The standard module-preload helper fetches packaged module links only; no response feeds an execution sink. — assets/popup.js:1
Executes one fixed function embedded in the packaged worker. — assets/background.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Uses chrome.runtime.onMessage for fixed internal commands and does not listen for window message events. — assets/content-main.js:1
Queries the active tab and sends internal messages with chrome.tabs.sendMessage. — assets/popup.js:105
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Always performs the same fixed file-name label injection when a permitted tab completes loading. — assets/background.js:1
File actions depend only on direct user choices and local saved state. — assets/popup.js:105
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The service worker only listens for tab completion and injects a small fixed DOM label. — assets/background.js:1
Application work consists of local CRUD for drawing files and collections. — assets/popup.js:105
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Mutates only localStorage.excalidraw and its own .file-name-div; it does not target form, input, action, or formAction properties. — assets/content-main.js:1
The injected script creates a div with textContent and styling, not a form or input mutation. — assets/background.js:1