skills/abudhahir/projects-pkm/mermaid/Gen Agent Trust Hub

mermaid

Warn

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/render.ts contains logic in the ensureDependency function to automatically download and install the beautiful-mermaid package using execSync('npm install beautiful-mermaid', ...) if it is not already present. This pattern facilitates the execution of external, unverifiable code from a public registry at runtime.
  • [COMMAND_EXECUTION]: The scripts/render.ts utility uses the execSync function from the child_process module to run arbitrary shell commands for dependency management.
  • [EXTERNAL_DOWNLOADS]: The skill attempts to fetch external code (NPM packages) from the internet during the execution of its rendering script.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 22, 2026, 01:12 PM
Security Audit — agent-trust-hub — mermaid