mermaid-diagrams

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the @mermaid-js/mermaid-cli package from the public NPM registry to validate diagrams. This is documented as part of the validation workflow using the official renderer.
  • [REMOTE_CODE_EXECUTION]: Through the validate_mermaid_markdown.sh script, the skill executes code from the downloaded Mermaid CLI package. This is a functional requirement for verifying that diagrams will render correctly on platforms like GitHub.
  • [COMMAND_EXECUTION]: The skill utilizes bash scripts to perform static analysis (density checks) and dynamic validation of Mermaid code blocks within markdown files. These scripts utilize standard POSIX tools like awk and rg.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied markdown files, which serves as an ingestion point for untrusted data. While no explicit boundary markers are used for the content itself, the capability inventory is focused on analysis tools and the official Mermaid CLI. Sanitization is performed via shell quoting and path validation within the provided validation scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 03:10 PM