sf-diagram-mermaid
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes two Python scripts that execute commands via the
subprocessmodule.scripts/query-org-metadata.pyinvokes the Salesforce CLI (sf) to fetch record counts and sharing models.scripts/mermaid_preview.pyusessubprocess.Popento launch itself as a background daemon. Both scripts use list-based command arguments withoutshell=True, which is a secure pattern that prevents shell injection. - [DYNAMIC_EXECUTION]: The skill provides a local HTTP server (
scripts/mermaid_preview.py) to provide live-reloading previews of diagrams in a browser. This server runs onlocalhost, uses Server-Sent Events (SSE) for reloading, and does not serve arbitrary files from the filesystem, limiting its security surface area. The HTML template used by the server includes basic escaping for the Mermaid code strings to prevent script injection within the preview context. - [EXTERNAL_DOWNLOADS]: The preview server's HTML template loads the Mermaid.js library from the
jsdelivrCDN. This is a common and standard practice for web-based diagramming tools.
Audit Metadata