Security audit

Anymermaid Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Mermaid diagram helper, but its setup and troubleshooting guidance includes risky unpinned package execution and weakened browser security settings.

Review before installing. Prefer installing a pinned, reviewed Mermaid CLI version in a project with a lockfile, avoid one-shot npx/dlx/bunx execution for sensitive work, and do not disable the Chromium sandbox unless rendering only trusted diagrams inside a constrained environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:123
Finding: Unpinned Package Retrieval and Immediate Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:265
Finding: Chromium Sandbox Disabled During Mermaid Rendering
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger conditions are extremely broad, including generic phrases like '画个图' and instructing proactive use even when the user did not request Mermaid explicitly. Overbroad activation can cause the agent to invoke this skill in unrelated contexts, leading to unintended file creation and shell command execution (mmdc, file writes, open commands) on user systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The natural-language description and instructions are entirely in Chinese, and the skill does not indicate any user language choice or opt-in behavior. This can violate language or locale policy when the broader environment or user has not explicitly requested Chinese-only interaction.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The skill instructs use of npx -p @mermaid-js/mermaid-cli without pinning a specific version, which allows execution of whatever package version is current at runtime. This creates a supply-chain risk: a malicious or compromised upstream release could be fetched and executed on the user's machine without review, especially because the command is presented as a recommended fallback.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: The unpinned npx @mermaid-js/mermaid-cli guidance similarly permits downloading and executing the latest package version at invocation time. In a skill that encourages command execution, this increases exposure to dependency hijacking, malicious releases, or breaking changes that can lead to unsafe or unexpected code execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.