beautiful-mermaid

Warn

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/render.ts uses execSync to programmatically execute shell commands for package installation and uses dynamic import() to load the beautiful-mermaid module after installation.
  • [EXTERNAL_DOWNLOADS]: The ensurePackage function in scripts/render.ts attempts to download and install the beautiful-mermaid package from the npm registry if it is not present in the environment.
  • [COMMAND_EXECUTION]: The skill instructions and scripts involve executing several shell commands, including npx tsx for running TypeScript logic and CLI calls to the agent-browser tool for rendering and capturing diagrams.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts and processes Mermaid diagram syntax from users. Maliciously crafted diagram code could attempt to exploit the rendering engine or the browser environment used to generate the final PNG output.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 15, 2026, 07:50 PM