mermaid-architecture

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:47 PM UTC
• Version: 1.0.0

Overview

This diagramming skill is mostly coherent, but needs Review because its normal image-rendering path can automatically download and run an unpinned npm package.

Install only if you are comfortable with local diagram-rendering commands. Prefer installing a trusted, pinned Mermaid CLI yourself and avoid the automatic npx fallback, especially in repositories with secrets or broad local credentials available to the agent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/extract_mermaid.py:212
• Finding: Automatic execution of an unpinned Mermaid CLI package in diagram extraction## Vulnerability Details **File Location**: `scripts/extract_mermaid.py:212-217` **Vulnerability Type**: Unpinned third-party package download and execution **Risk Level**: Medium **Vulnerable code:** ```python @staticmethod def _get_mmdc_cmd() -> Optional[List[str]]: """Find working mmdc command (direct binary or npx fallback).""" import shutil if shutil.which('mmdc'): return ['mmdc'] if shutil.which('npx'): return ['npx', '-y', '@mermaid-js/mermaid-cli'] return None ``` The resulting command is executed during validation: ```python mmdc_cmd = self._get_mmdc_cmd() or ['mmdc'] cmd = mmdc_cmd + ['-i', str(input_file), '-o', str(output_file), '-b', 'transparent'] result = subprocess.run( cmd, capture_output=True, text=True, timeout=30 ) ``` ### Technical Analysis If a trusted, preinstalled `mmdc` binary is unavailable, the script treats the presence of `npx` as sufficient and invokes: ```text npx -y @mermaid-js/mermaid-cli ``` The package version is not pinned, no lockfile or integrity value is enforced, and `-y` suppresses interactive confirmation. Consequently, npm can retrieve and execute a package version and transitive dependency set that changed after the Skill was audited. The use of an argument list rather than a shell command prevents ordinary shell metacharacter injection through file paths. The vulnerability is instead the implicit trust placed in mutable remote package contents. ### Attack Path 1. An attacker compromises the npm package, one of its transitive dependencies, or the relevant package-distribution channel. 2. The attacker publishes malicious code under a version accepted by the unversioned package request. 3. A user invokes `extract_mermaid.py --validate` on a system where `npx` exists but `mmdc` is not installed. 4. The script automatically runs `npx -y @mermaid-js/mermaid-cli`. 5. npm downloads the cu ...[truncated 607 chars]
• Remediation: ## Remediation Suggestions 1. Remove the automatic `npx -y` fallback. Fail safely when a trusted `mmdc` installation is unavailable. 2. Require explicit user approval before downloading or executing any package. 3. Pin Mermaid CLI to an audited exact version rather than using an unversioned package reference. 4. Install dependencies through a committed lockfile and verify package integrity before execution. 5. Prefer a project-local binary from a controlled dependency installation, such as `node_modules/.bin/mmdc`. 6. Run rendering in a sandbox with restricted filesystem access, minimal environment variables, no unnecessary credentials, and network access disabled after dependency installation. 7. Clearly document whether validation may access the network and provide an offline-only mode.

T08 · Insecure Dependencies

Warning

• Location: scripts/mermaid_to_image.py:214
• Finding: Automatic execution of an unpinned Mermaid CLI package during image rendering## Vulnerability Details **File Location**: `scripts/mermaid_to_image.py:214-219` **Vulnerability Type**: Unpinned third-party package download and execution **Risk Level**: Medium **Vulnerable code:** ```python @staticmethod def _get_mmdc_cmd() -> Optional[List[str]]: """Find working mmdc command (direct binary or npx fallback).""" import shutil if shutil.which('mmdc'): return ['mmdc'] if shutil.which('npx'): return ['npx', '-y', '@mermaid-js/mermaid-cli'] return None ``` The selected command is later executed as follows: ```python mmdc_cmd = self._get_mmdc_cmd() or ['mmdc'] cmd = list(mmdc_cmd) + ['-i', str(input_path), '-o', str(output_path)] result = subprocess.run( cmd, capture_output=True, text=True, timeout=60 ) ``` ### Technical Analysis The renderer automatically falls back from a locally installed `mmdc` executable to an unversioned npm package. Because `npx -y` can retrieve and execute the latest package selected by npm without confirmation, the actual executable payload is not fixed to the code reviewed in this repository. This behavior exceeds the minimum privileges needed to convert Mermaid diagrams when a trusted local renderer could instead be required. The subprocess call does not use `shell=True`, so no direct command injection was identified. The security issue is remote supply-chain trust and automatic execution. ### Attack Path 1. A malicious release or compromised dependency enters the Mermaid CLI npm dependency chain. 2. A user requests a single or batch image conversion on a host with `npx` but without `mmdc`. 3. `MermaidRenderer` accepts `npx` as an available renderer. 4. The rendering operation invokes the unpinned package with automatic confirmation. 5. npm retrieves and runs the compromised package. 6. The attacker's code runs within the user's process context before or during image generation. ### Im ...[truncated 430 chars]
• Remediation: ## Remediation Suggestions 1. Do not use `npx -y` as an implicit renderer fallback. 2. Require an explicitly installed and trusted `mmdc` binary, or require user confirmation before package retrieval. 3. Pin the package to an audited exact version and manage it with a lockfile containing verified integrity metadata. 4. Resolve a project-local executable from a controlled installation rather than dynamically resolving the npm registry's current package. 5. Add an offline mode that refuses network-based dependency installation. 6. Execute rendering in an isolated, low-privilege environment with only the required input and output directories mounted.

T08 · Insecure Dependencies

Warning

• Location: scripts/resilient_diagram.py:441
• Finding: Automatic execution of an unpinned Mermaid CLI package in the resilient generation workflow## Vulnerability Details **File Location**: `scripts/resilient_diagram.py:441-446` **Vulnerability Type**: Unpinned third-party package download and execution **Risk Level**: Medium **Vulnerable code:** ```python @staticmethod def _get_mmdc_cmd() -> Optional[List[str]]: """Find working mmdc command (direct binary or npx fallback).""" import shutil if shutil.which('mmdc'): return ['mmdc'] if shutil.which('npx'): return ['npx', '-y', '@mermaid-js/mermaid-cli'] return None ``` The package command is executed by the rendering workflow: ```python mmdc_cmd = self._get_mmdc_cmd() if not mmdc_cmd: return False, None, "mmdc not found. Install with: npm install -g @mermaid-js/mermaid-cli or ensure npx is available" try: cmd = mmdc_cmd + ['-i', str(mmd_path), '-o', str(image_path), '-b', 'transparent'] result = subprocess.run( cmd, capture_output=True, text=True, timeout=60 ) ``` The behavior is also explicitly advertised in `SKILL.md:109`: ```text If `mmdc` is not installed globally, the script automatically uses `npx -y @mermaid-js/mermaid-cli`. ``` ### Technical Analysis The primary generation workflow automatically downloads and executes a mutable npm package whenever `mmdc` is absent and `npx` is available. The package reference has no exact version and the repository contains no associated lockfile or integrity enforcement for this execution path. Since this workflow is the recommended command in `SKILL.md`, the unsafe fallback is likely to be exercised during normal Skill use. Although subprocess arguments are safely separated and no shell injection was identified, remote package contents receive the same local privileges as the Python process. ### Attack Path 1. An attacker compromises a Mermaid CLI release, a transitive dependency, or the package-distribution path. 2. A user follows the documen ...[truncated 881 chars]
• Remediation: ## Remediation Suggestions 1. Replace the automatic fallback with a clear error requiring installation of an approved renderer. 2. If fallback installation is retained, require explicit user consent and pin an audited exact package version. 3. Commit and enforce a dependency lockfile with integrity values. 4. Separate dependency installation from diagram rendering so rendering never performs an implicit network download. 5. Prefer a verified project-local `mmdc` executable and record its expected version. 6. Restrict the renderer's filesystem, credential, environment, and network access through sandboxing or container isolation. 7. Update `SKILL.md` to disclose the network and code-execution implications and document a secure offline installation procedure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The manifest describes a narrowly scoped documentation skill, but the content indicates broader rendering and processing behavior, including image conversion, batch handling, and operation on arbitrary files or directories. This mismatch can mislead users and orchestration layers about what the skill is allowed to do, causing overbroad execution and weakening trust boundaries.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: mermaid-architecture
description: Use when generating, documenting, or updating architecture diagrams, flowcharts, sequence, ER, class, or state diagrams using Mermaid in docs/architecture/.
license: MIT
metadata:
  version: 1.0.0
  visibility: public
  author: merged from SpillwaveSolutions/design-doc-mermaid
  url: https://github.com/afonsoft/skills
  homepage: https://github.com/SpillwaveSolutions/design-doc-mermaid
  sources: https://github.com/SpillwaveSolutions/design-doc-mermaid
---

# Mermaid Architecture Diagrams

Create structured, high-contrast, production-ready Mermaid architecture diagrams, workflows,

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Ae1

High

• Category: analysis-evasion

Content

| Database Design | `assets/database-design-template.md` | `docs/architecture/database-design.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

User2[GET /users/:id]
        User3[POST /users]
        User4[PUT /users/:id]
        User5[DELETE /users/:id]
    end

    subgraph "Resources"

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Res2[GET /resources/:id]
        Res3[POST /resources]
        Res4[PUT /resources/:id]
        Res5[DELETE /resources/:id]
    end
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

#### POST /auth/login

Authenticate a user and receive access token.

**Request:**
```json

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

User->>Client: Login
    Client->>AuthServer: POST /oauth/token
    AuthServer->>AuthServer: Validate Credentials
    AuthServer-->>Client: Access Token + Refresh Token
    Client->>ResourceServer: GET /resource<br/>Authorization: Bearer {token}
    ResourceServer->>AuthServer: Validate Token
    AuthServer-->>ResourceServer: Token Valid + Claims

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

LOG_LEVEL: str = "INFO"

    class Config:
        env_file = ".env"
```

**Configuration Diagram:**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Hidden Instructions

High

• Category: Prompt Injection

Content

<display-name>Contact Management App</display-name>

    <!-- Context Parameters -->
    <context-param>
        <param-name>db.url</param-name>
        <param-value>jdbc:mysql://localhost:3306/contacts</param-value>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

```xml
<web-app>
    <!-- Filter execution order defined by order in web.xml -->

    <!-- 1. Logging Filter - First to log all requests -->
    <filter>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Kafka consumer/producer code gives concrete capability for real-time ingestion and publishing to output and dead-letter topics, which is unjustified for a Mermaid architecture skill. In the skill context, this is especially risky because the presence of executable messaging logic may lead an agent to assist with or generate system-impacting data movement under the guise of documentation support.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Component->>Hook: handleDelete(id)

    Hook->>Redux: dispatch(deleteContact(id))
    Redux->>API: DELETE /api/contacts/:id

    API-->>Redux: 204 No Content
    Redux->>Redux: Remove from state

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Hidden Instructions

High

• Category: Prompt Injection

Content

**Example Mapping:**

```xml
<!-- web.xml -->
<servlet>
    <servlet-name>ContactServlet</servlet-name>
    <servlet-class>com.example.ContactServlet</servlet-class>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High

• Category: Privilege Escalation

Content

AuthService->>+DB: SELECT * FROM users<br/>WHERE email = ?
    DB-->>-AuthService: User record
    AuthService->>AuthService: Verify password hash
    AuthService->>AuthService: Generate JWT access token<br/>(expires in 15 min)
    AuthService->>AuthService: Generate refresh token<br/>(expires in 7 days)
    AuthService->>+DB: INSERT INTO refresh_tokens<br/>(user_id, token, expires_at)
    DB-->>-AuthService: OK

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

AuthService->>+DB: SELECT * FROM users<br/>WHERE email = ?
    DB-->>-AuthService: User record
    AuthService->>AuthService: Verify password hash
    AuthService->>AuthService: Generate JWT access token<br/>(expires in 15 min)
    AuthService->>AuthService: Generate refresh token<br/>(expires in 7 days)
    AuthService->>+DB: INSERT INTO refresh_tokens<br/>(user_id, token, expires_at)
    DB-->>-AuthService: OK

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Client->>+API: GET /users/123
    API-->>-Client: ✅ HTTP 200 OK

    Client->>+API: DELETE /users/123
    API-->>-Client: ✅ HTTP 204 No Content

    Client->>+API: GET /users/999

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

sequenceDiagram
    Note over Client,Server: OAuth 2.0 Authentication Flow

    Client->>AuthServer: Request Access Token
    Note right of AuthServer: Validates client credentials
    AuthServer-->>Client: Access Token (JWT)
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

sequenceDiagram
    Note over Client,Server: OAuth 2.0 Authentication Flow

    Client->>AuthServer: Request Access Token
    Note right of AuthServer: Validates client credentials
    AuthServer-->>Client: Access Token (JWT)
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill directs the agent to read and write repository files and execute shell commands, but it declares no explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where a runtime may grant broader capabilities than users expect, increasing the chance of unintended file modification or command execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Referencing @mermaid-js/mermaid-cli via npx without a pinned version allows the tool version resolved at execution time to change unexpectedly. This creates a supply-chain risk where a compromised or breaking upstream release could execute unreviewed code in the agent environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The fallback instruction to use npx -y @mermaid-js/mermaid-cli performs runtime package retrieval and auto-confirms installation without version pinning. In an agent workflow, that expands supply-chain exposure and reduces operator visibility into what code is being downloaded and executed.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2.1 Base URL

```
Production:  https://api.example.com/v1
Staging:     https://api-staging.example.com/v1
Development: http://localhost:8000/v1
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2.1 Base URL

```
Production:  https://api.example.com/v1
Staging:     https://api-staging.example.com/v1
Development: http://localhost:8000/v1
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2.1 Base URL

```
Production:  https://api.example.com/v1
Staging:     https://api-staging.example.com/v1
Development: http://localhost:8000/v1
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 15. API Client Examples

### 15.1 cURL

```bash
curl -X POST https://api.example.com/v1/resources \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.