tldraw
LibraryInfinite canvas SDK
Use it when you need an infinite canvas or whiteboard inside your React app
An SDK for building infinite canvas apps in React, with a whiteboard-ready default tool set.
Added to the shelf
From the makersREADME, read 15 Oct
tldraw is a React SDK for building infinite canvas apps, with a feature-complete canvas engine for custom shapes, tools, bindings and UI components. It ships default whiteboarding tools, drawing and diagramming features, an Editor API for driving the canvas at runtime, and canvas primitives for building with LLMs. Self-hostable real-time collaboration is available through @tldraw/sync. Production use requires a license key.
Install
npm i tldrawCommands
npm i tldrawInstall the tldraw package
npx create-tldraw@latestScaffold a starter kit
pnpm devRun the examples app locally on localhost:5420
- Needs
- Node.js ^20.0.0 for local development; React app to embed the <Tldraw /> component.
How creators use itNone yet
No creator takes yet. This one came straight from its repo.
Safety checkWorth a look, SkillSpector, 19 Oct
It found something worth reading before you install it.
Finding (medium, rule SQP-2)
skills/shepherd-pr/SKILL.md:3
The skill pushes commits to the PR branch, posts public replies, and resolves review threads, all without a per-action confirmation step. It also reads reviewer comments, which are untrusted text written by third parties, and acts on them autonomously. A crafted review comment could steer the agent into pushing unwanted changes, dismissing legitimate feedback, or editing test expectations. The description does say "autonomously," so this is a consent and scoping weakness rather than hidden behav
Finding (medium, rule SQP-2)
skills/tldraw-migrate/README.md:29
The install and update commands download the live `main` branch tarball from GitHub and extract it straight into the project's agent-skills directory with no pinned version or checksum. The helper `.mjs` scripts are then run by the agent, so anyone who compromises the upstream repo, or a MITM on the connection, could deliver code that executes on developers' machines. The README also tells users to re-run the command to update, which overwrites local files without warning.
SkillSpector’s own score is 100/100 from 61 findings; only the ones its AI check confirmed count here.