design-doc-mermaid

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes Python scripts (scripts/extract_mermaid.py, scripts/mermaid_to_image.py, and scripts/resilient_diagram.py) that call the mmdc (Mermaid CLI) tool via subprocess.run().
  • These calls are central to the skill's functionality for validating and rendering diagrams.
  • The implementation uses list-based arguments for subprocess.run(), which is a standard security practice to prevent shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill's documentation advises users to install the @mermaid-js/mermaid-cli package via npm.
  • This tool is a well-known industry standard for rendering Mermaid diagrams and originates from a trusted official registry.
  • [SAFE]: The skill was audited against all 11 threat categories, including persistent mechanisms, privilege escalation, and data exfiltration.
  • No suspicious or malicious patterns were identified in the metadata, instructions, or scripts.
  • All resources and links provided originate from known vendor domains or reputable public repositories.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 05:57 PM
Security Audit — agent-trust-hub — design-doc-mermaid