skills/chrislacey89/skills/mermaid/Gen Agent Trust Hub

mermaid

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's verification instructions suggest using npx to download the @mermaid-js/mermaid-cli package, which is the official tool for Mermaid diagram generation.
  • [COMMAND_EXECUTION]: A bash script is provided in the SKILL.md for diagram validation, utilizing standard system tools like awk and grep alongside the Mermaid CLI.
  • [REMOTE_CODE_EXECUTION]: The verification process involves running the Mermaid CLI fetched via npx to ensure diagram validity.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text to generate code and reads local markdown files to perform syntax checks. Ingestion points: User descriptions and file paths provided to the verification script. Boundary markers: The instructions mandate wrapping generated code in ```mermaid fenced blocks. Capability inventory: The skill uses shell execution (awk, npx, mmdc) for its verification recipe. Sanitization: The documentation includes a list of parse pitfalls to help the agent avoid syntax errors, though it does not explicitly sanitize data for security purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:36 PM