beautiful-mermaid
Warn
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation and use of the
beautiful-mermaidpackage from the NPM registry and GitHub repositorylukilabs/beautiful-mermaid. Aslukilabsis not a listed trusted organization and is unaffiliated with the skill author 'ThinkfleetAI', it is considered an unverifiable external dependency. - [PROMPT_INJECTION]: The skill processes untrusted user-provided Mermaid code blocks, creating a risk of indirect prompt injection.
- Ingestion points: User-supplied Mermaid code blocks (
mermaid ...) analyzed inSKILL.md. - Boundary markers: Absent. The skill does not provide instructions to the agent to ignore or delimit potentially malicious instructions embedded within the diagram syntax.
- Capability inventory: Uses
renderMermaidto generate SVG output andrenderMermaidAsciifor text output, which may be rendered in sensitive UI contexts. - Sanitization: None mentioned. The skill does not describe any validation or escaping of the input Mermaid text or the resulting SVG output to prevent potential injection or cross-site scripting (XSS) vectors.
Audit Metadata