mermaid-to-image
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches rendered PNG files from the mermaid.ink API over HTTPS.
- [COMMAND_EXECUTION]: Employs the
lscommand to inspect the project structure for common image directories such asimages/,assets/, orstatic/images/. - [DYNAMIC_EXECUTION]: Generates and runs a Python script that uses the
base64andurllib.requestmodules to encode diagram data and perform the API call. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface by reading and processing content from external Markdown files. The impact is mitigated as the skill performs a specific transformation (base64 encoding) on the ingested data before it is used in network operations.
Audit Metadata