mermaid-architecture-diagrams

Pass

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the execution of scripts/render-mmd.sh to render Mermaid source files into PNG images. This script performs several subprocess calls to tools like quarto, mmdc, and system utilities such as sips or magick for image processing.
  • [EXTERNAL_DOWNLOADS]: The rendering script scripts/render-mmd.sh may use npx to download and run the @mermaid-js/mermaid-cli package if it is not already installed on the system. This is a well-known service providing the official command-line interface for Mermaid diagrams.
  • [DYNAMIC_EXECUTION]: scripts/render-mmd.sh contains an embedded Python script within a heredoc block that is executed at runtime to generate image previews. This script uses the PIL (Pillow) library to perform image resizing.
  • [REMOTE_CODE_EXECUTION]: The use of npx -y @mermaid-js/mermaid-cli within the rendering script involves fetching and executing code from a remote package registry. While this targets a well-known and official package, it represents a pattern of executing remote code during the skill's lifecycle.
  • [COMMAND_EXECUTION]: The render-mmd.sh script searches the host system for Chrome or Chromium executables in standard paths (e.g., /usr/bin/google-chrome, /Applications/Google Chrome.app/...) to provide the necessary browser environment for the Mermaid CLI's Puppeteer dependency.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 24, 2026, 02:44 PM
Security Audit — agent-trust-hub — mermaid-architecture-diagrams