mermaid
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/render.tscontains logic in theensureDependencyfunction to automatically download and install thebeautiful-mermaidpackage usingexecSync('npm install beautiful-mermaid', ...)if it is not already present. This pattern facilitates the execution of external, unverifiable code from a public registry at runtime. - [COMMAND_EXECUTION]: The
scripts/render.tsutility uses theexecSyncfunction from thechild_processmodule to run arbitrary shell commands for dependency management. - [EXTERNAL_DOWNLOADS]: The skill attempts to fetch external code (NPM packages) from the internet during the execution of its rendering script.
Audit Metadata