The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/validate-mermaid.sh script is vulnerable to command injection. The $FILE variable is directly expanded by the shell into a Node.js execution string (node -e), allowing a specially crafted filename to break out of the string literal and execute arbitrary JavaScript or shell commands.\n- [PRIVILEGE_ESCALATION]: Documentation in references/pdf-rendering-pipeline.md suggests using the --no-sandbox and --disable-setuid-sandbox flags with Puppeteer. Disabling the browser sandbox is a significant security risk that could allow malicious diagram content to exploit the browser engine and gain unauthorized access to the host system.\n- [DYNAMIC_EXECUTION]: The validation script uses node -e to evaluate code constructed from unvalidated shell environment variables, creating a direct path for arbitrary code execution via string interpolation.

mermaid-diagrams