ClawHub
Back to skill

Security audit

Anymermaid Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Mermaid diagram helper that writes and renders diagram files, with only minor caution around broad activation and local viewer/CLI use.

Install this if you want agents to generate Mermaid diagrams. Be aware it may activate on broad diagram requests, will run the local Mermaid CLI when available, may leave .mmd/output files in the working directory, and may open rendered files in a local viewer unless the environment is headless.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

High
Confidence
97% confidence
Finding
The trigger conditions are overly broad, including generic phrases like '画个图' and instructions to proactively use the skill even when the user did not specify Mermaid. This can cause the agent to invoke the skill in contexts where diagram rendering was not intended, increasing the chance of unintended file creation, command execution, or use of external tooling on ambiguous requests.

Static analysis

No suspicious patterns detected.