mermaid-architecture-diagrams
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of
scripts/render-mmd.shto render Mermaid source files into PNG images. This script performs several subprocess calls to tools likequarto,mmdc, and system utilities such assipsormagickfor image processing. - [EXTERNAL_DOWNLOADS]: The rendering script
scripts/render-mmd.shmay usenpxto download and run the@mermaid-js/mermaid-clipackage if it is not already installed on the system. This is a well-known service providing the official command-line interface for Mermaid diagrams. - [DYNAMIC_EXECUTION]:
scripts/render-mmd.shcontains an embedded Python script within a heredoc block that is executed at runtime to generate image previews. This script uses thePIL(Pillow) library to perform image resizing. - [REMOTE_CODE_EXECUTION]: The use of
npx -y @mermaid-js/mermaid-cliwithin the rendering script involves fetching and executing code from a remote package registry. While this targets a well-known and official package, it represents a pattern of executing remote code during the skill's lifecycle. - [COMMAND_EXECUTION]: The
render-mmd.shscript searches the host system for Chrome or Chromium executables in standard paths (e.g.,/usr/bin/google-chrome,/Applications/Google Chrome.app/...) to provide the necessary browser environment for the Mermaid CLI's Puppeteer dependency.
Audit Metadata