pretty-mermaid

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime loaders call npm install and then import the 'beautiful-mermaid' dependency (which the package-lock resolves to https://registry.npmjs.org/beautiful-mermaid/-/beautiful-mermaid-1.1.3.tgz), causing remote JavaScript packages (and their transitive tarballs) to be fetched at runtime and executed as code.