mermaid-diagram
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @mermaid-js/mermaid-cli@latestto download and execute the Mermaid CLI during the verification step. This operation fetches the official tool from the npm registry, a well-known service, and is necessary for validating the generated diagram syntax. - [COMMAND_EXECUTION]: Shell commands are used to manage the environment and run the diagram generator, including
mkdirfor directory creation andmmdc/npxfor rendering. These commands are directly tied to the skill's primary purpose and operate within thefigures/directory. - [PROMPT_INJECTION]: The skill ingests user requirements to generate diagram code, which represents an indirect prompt injection surface. However, the instructions mandate a strict 6-step workflow and a detailed manual review process that the agent must follow, providing a structured framework that reduces the likelihood of successful injection attacks.
Audit Metadata