design-doc-mermaid
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python scripts (
scripts/extract_mermaid.py,scripts/mermaid_to_image.py, andscripts/resilient_diagram.py) that call themmdc(Mermaid CLI) tool viasubprocess.run(). - These calls are central to the skill's functionality for validating and rendering diagrams.
- The implementation uses list-based arguments for
subprocess.run(), which is a standard security practice to prevent shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill's documentation advises users to install the
@mermaid-js/mermaid-clipackage via npm. - This tool is a well-known industry standard for rendering Mermaid diagrams and originates from a trusted official registry.
- [SAFE]: The skill was audited against all 11 threat categories, including persistent mechanisms, privilege escalation, and data exfiltration.
- No suspicious or malicious patterns were identified in the metadata, instructions, or scripts.
- All resources and links provided originate from known vendor domains or reputable public repositories.
Audit Metadata