agentic-mermaid-diagram-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill features an
executetool designed to run JavaScript snippets to handle complex control flows that standard tools cannot express. Documentation inreferences/code-mode.mdspecifies that this code is executed within anode:vmsandbox environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes Mermaid source code which can include interaction syntax such as
clickevents andcallbackfunctions. This presents an indirect prompt injection surface if the diagrams are rendered with loose security settings. The instructions inreferences/upstream/classDiagram.mdandSKILL.mddemonstrate and recommend using astrictsecurity level to prevent unauthorized script execution. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documents a 'hosted MCP' channel that communicates with
https://agentic-mermaid.dev/mcp. This involves sending diagram source and custom execution code to a remote endpoint. The skill author responsibly advises users inreferences/hosted-mcp.mdto prefer local channels (library, CLI, or stdio MCP) when working with sensitive data.
Audit Metadata