Security audit

Mechanism Flowchart

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core code is a local Mermaid diagram generator, but its install instructions pull unnecessary unpinned packages and its activation scope is broader than its medical diagram purpose.

Review before installing. The diagram generator itself appears narrow and local, but avoid running the documented pip install step as written; remove the unnecessary dependencies or pin and verify any packages first. Treat Mermaid output generated from untrusted text as untrusted and render it only with a restrictive Mermaid security configuration.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unnecessary Unpinned Dependencies Create Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:38
Finding: User-Controlled Mermaid Syntax Injection Through Ineffective Label Escaping
Content: View full analysis
str: """Convert to Mermaid syntax.""" # Escape special characters label = self.label.replace('"', '"') return f' {self.id}["{label}"]' ``` User-controlled labels reach this method through the text parser at `scripts/main.py:84-100`: ```python def _extract_nodes_from_text(self, text: str) -> List[str]: """Extract potential nodes from text description.""" # Split by common delimiters delimiters = r'[;,.]|\band\b|\bthen\b|\bwhich\b' parts = re.split(delimiters, text, flags=re.IGNORECASE) nodes = [] for part in parts: part = part.strip() # Clean up the text part = re.sub(r'\s+', ' ', part) # Remove leading connecting words part = re.sub(r'^(leads? to|causes?|results? in|triggers?|and|or)\s+', '', part, flags=re.IGNORECASE) if len(part) > 3: # Minimum meaningful length nodes.append(part) return nodes ``` ### Technical Analysis The statement `self.label.replace('"', '"')` replaces each quotation mark with the same character and therefore performs no escaping. Labels derived from arbitrary mechanism descriptions are interpolated directly into a quoted Mermaid node. An attacker can include syntax-significant characters such as quotation marks, closing brackets, braces, or line breaks. These characters may terminate the intended node declaration and inject additional Mermaid declarations or directives. The generated document can therefore contain graph structure and behavior that the application did not intend to produce. The immediate implementation only returns Mermaid text. Any further effect depends on the downstream Mermaid renderer, its version, enabled features, and security configuration. This audit does not establish direct operating-system comma ...[truncated 1235 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is broader than the stated purpose of generating medical/pathophysiology Mermaid diagrams, including generic data-analysis use. Overbroad routing criteria can cause the wrong skill to be invoked on inputs it is not designed to handle, which increases the risk of unsafe assumptions, misuse of scripts, or inappropriate processing of files and user data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger text broadens activation from a narrowly defined pathophysiology flowchart skill to generic data analysis tasks requiring assumptions, bounded scope, and reproducible output. That can cause the agent to route unrelated requests into this skill, increasing the chance of out-of-scope execution, misleading outputs, and bypass of more appropriate safety or domain-specific handling. The audit evidence also supports this concern because the stress case recorded scope-boundary and guidance failures.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The risk assessment states 'Network Access | No external API calls' even though this file is only documentation and does not include the referenced implementation in scripts/main.py. Because the document makes a concrete behavioral claim about runtime behavior that is not demonstrated here, the documentation overstates what is established by the artifact being reviewed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The file claims the skill reads input files, writes output files, validates paths against traversal, and restricts output to the workspace, yet this markdown file contains no executable logic implementing those controls. That creates an intent-versus-evidence gap where the documentation presents safeguards as if they are active behavior.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses enum

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
dataclasses enum

Static analysis

No suspicious patterns detected.