mermaid-diagrams
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
@mermaid-js/mermaid-clipackage from the public NPM registry to validate diagrams. This is documented as part of the validation workflow using the official renderer. - [REMOTE_CODE_EXECUTION]: Through the
validate_mermaid_markdown.shscript, the skill executes code from the downloaded Mermaid CLI package. This is a functional requirement for verifying that diagrams will render correctly on platforms like GitHub. - [COMMAND_EXECUTION]: The skill utilizes bash scripts to perform static analysis (density checks) and dynamic validation of Mermaid code blocks within markdown files. These scripts utilize standard POSIX tools like
awkandrg. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied markdown files, which serves as an ingestion point for untrusted data. While no explicit boundary markers are used for the content itself, the capability inventory is focused on analysis tools and the official Mermaid CLI. Sanitization is performed via shell quoting and path validation within the provided validation scripts.
Audit Metadata