mermaid-to-gif
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script mermaid_to_gif.py invokes the ffmpeg utility using subprocess.run to assemble captured frames into a GIF. The implementation uses argument lists rather than shell strings, which mitigates the risk of command injection.
- [DYNAMIC_EXECUTION]: The skill generates a temporary HTML file containing the diagram source and renders it using Playwright. The Mermaid renderer is configured with securityLevel: 'loose', which allows the inclusion of HTML tags and labels in the diagrams, increasing the potential attack surface of the rendering process.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied markdown and mermaid files to extract diagram code. This creates a surface for indirect prompt injection where malicious input could exploit the diagram rendering engine. Evidence: (1) Ingestion points: Input files are read in scripts/mermaid_to_gif.py. (2) Boundary markers: Absent; no markers are used to distinguish instructions from data. (3) Capability inventory: Subprocess execution (ffmpeg) and browser execution (Playwright). (4) Sanitization: The renderer is configured with loose security settings.
- [EXTERNAL_DOWNLOADS]: The rendering template includes a reference to the Mermaid.js library hosted on cdn.jsdelivr.net, a common and well-known content delivery network.
Audit Metadata