aris-mermaid-diagram
Warn
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a user-derived string for the diagram name and interpolates it directly into shell commands for file creation and verification (e.g.,
mmdc -i figures/<diagram-name>.mmd). While the instructions recommend using kebab-case, the lack of strict sanitization or escaping could allow for command injection if the agent includes shell metacharacters in the filename derived from user requirements. - [EXTERNAL_DOWNLOADS]: The skill includes a fallback mechanism that uses
npx -y @mermaid-js/mermaid-cli@latestto download and execute the official Mermaid CLI from the public npm registry. This occurs during the mandatory syntax verification step if the tool is not already present on the system. - [PROMPT_INJECTION]: The skill processes untrusted user requirements ($ARGUMENTS) to influence its logic and generated code. It lacks boundary markers (like XML tags or delimiters) to separate user data from instructions, which creates a surface for indirect prompt injection where a user might attempt to override the skill's verification or scoring logic.
Audit Metadata