diagram-to-image
Warn
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
run.pyscript allows users to specify an arbitraryoutputfile path. This parameter is passed directly to themmdcCLI tool, which could be exploited to overwrite sensitive local files if the agent is provided with a malicious output path.\n- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation of@mermaid-js/mermaid-clivianpm. This is a well-known and trusted package.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted Mermaid source code without sanitization.\n - Ingestion points: Untrusted Mermaid source code is ingested through the
codeparameter inrun.py.\n - Boundary markers: Absent; the input is written directly to a temporary file without delimiters or instructions to ignore embedded commands.\n
- Capability inventory: The skill can execute external commands via
subprocess.runand write files to the local filesystem inrun.py.\n - Sanitization: Absent; the script does not validate the contents of the Mermaid code or the destination of the output file path.
Audit Metadata