beautiful-mermaid
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/render.tsusesexecSyncto programmatically execute shell commands for package installation and uses dynamicimport()to load thebeautiful-mermaidmodule after installation. - [EXTERNAL_DOWNLOADS]: The
ensurePackagefunction inscripts/render.tsattempts to download and install thebeautiful-mermaidpackage from the npm registry if it is not present in the environment. - [COMMAND_EXECUTION]: The skill instructions and scripts involve executing several shell commands, including
npx tsxfor running TypeScript logic and CLI calls to theagent-browsertool for rendering and capturing diagrams. - [INDIRECT_PROMPT_INJECTION]: The skill accepts and processes Mermaid diagram syntax from users. Maliciously crafted diagram code could attempt to exploit the rendering engine or the browser environment used to generate the final PNG output.
Audit Metadata