skills/build000r/skills/mmdx/Gen Agent Trust Hub

mmdx

Warn

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/mmd.py script contains logic to automatically invoke npm install if required Node.js dependencies are missing. This downloads third-party packages (mermaid, jsdom) from the public npm registry at runtime.
  • [REMOTE_CODE_EXECUTION]: The skill performs dynamic execution by downloading external npm packages and executing them using a Node.js shim (scripts/validate_mermaid.mjs) to perform diagram syntax validation.
  • [COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to interact with host utilities, including osascript to control the browser, node for validation, and tmux for terminal interaction.
  • [DATA_EXFILTRATION]: The skill launches a local HTTP server (HandoffHTTPServer) that facilitates communication between the local filesystem and the buildooor.com web origin. It exposes a /source/read endpoint that allows the web-based viewer to retrieve the content of local diagram files.
  • [COMMAND_EXECUTION]: The local bridge server includes a /send endpoint that allows a web origin to paste text and optionally execute commands in an active tmux pane via the tmux send-keys utility.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 7, 2026, 03:53 PM