mermaid-diagram-generator
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
Bash,Grep, andGlobto search and read local project files, facilitating the analysis of system flows and architectures for diagramming. - [EXTERNAL_DOWNLOADS]: Generated HTML files fetch the Mermaid.js and html2canvas libraries from the JSDelivr CDN. These are well-known and trusted services for distributing open-source JavaScript packages.
- [DATA_EXFILTRATION]: The agent is instructed to read local codebase content to generate visualizations. This data remains within the local environment as it is written into local HTML files for the user.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where content read from project files is interpolated into generated HTML files and Mermaid blocks without explicit sanitization. While this could potentially lead to XSS if the analyzed code contains malicious strings, it is an inherent risk factor for visualization tools and does not indicate malicious intent in the skill itself.
Audit Metadata