mermaid-diagram-design
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes custom shell scripts (
scripts/assess_mermaid_density.shandscripts/validate_mermaid_markdown.sh) used for analyzing diagram complexity and validating syntax. These are intended to be executed by the agent as part of the diagram design workflow. - [EXTERNAL_DOWNLOADS]: The script
scripts/validate_mermaid_markdown.shutilizesnpx -y @mermaid-js/mermaid-clito download and execute the official Mermaid command-line tool. This is a standard practice for verifying that diagrams can be correctly rendered and follows the guidelines for utilizing well-known services. - [PROMPT_INJECTION]: The skill implements a validation workflow that processes external markdown files, creating a potential surface for indirect prompt injection.
- Ingestion points: Markdown files passed as arguments to the validation scripts in the
scripts/directory. - Boundary markers: None explicitly present in the shell scripts, though they perform static analysis or pass content to an external renderer.
- Capability inventory: The skill can read local files and execute shell commands (via its own scripts and
npx). - Sanitization: Input file paths are quoted in shell commands to prevent basic argument injection.
Audit Metadata