Security audit

Mermaid Visualizer

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only Mermaid diagram helper whose behavior is disclosed and proportionate to its visualization purpose.

Install only if you want the agent to handle Mermaid-style visualization requests automatically. Because the trigger language is broad, explicitly name the desired format when you want Mermaid, Excalidraw, Canvas, or another output, and review generated diagrams before using them in documentation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
- Wrap in proper code fence with optional explanation **Default assumptions:** - Vertical layout (TB) unless horizontal requested - Medium detail level (balanced between simplicity and information) - Professional color scheme with semantic colors - Obsidian/GitHub compatible syntax ## Diagram Types ### 1. Process Flow (graph TB/LR) **Best for:** Workflows, decision trees, sequential processes, AI agent architectures **Use when:** Content describes steps, stages, or a sequence of actions **Key features:** - Swimlanes via subgraph for grouping related steps - Arrow labels for transitions - Feedback loops and branches - Color-coded stages **Configuration options:** - `layout`: "vertical" (TB), "horizontal" (LR) - `detail`: "simple" (core steps only), "standard" (with descriptions), "detailed" (with annotations) - `style`: "minimal", "professional", "colorful" ### 2. Circular Flow (graph TD with circular layout) **Best for:** Cyclic processes, continuous improvement loops, agent fee

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
**Use when:** Content describes states and transitions between them **Key features:** - Clear state nodes - Labeled transitions - Start and end states

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Excalidraw trigger set includes highly generic terms such as 'diagram', 'flowchart', and 'mind map', which can cause the skill to activate for ordinary visualization requests that were not intended for this specific skill. In an agentic environment, overly broad matching increases the chance of incorrect tool/skill routing, unexpected file generation, or prompt-context hijacking by an unrelated skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Mermaid skill trigger words include broad terms like 'visualize' and 'flowchart', which are common in normal conversation and overlap with other visualization skills in the same pack. This ambiguity can lead to unintended invocation, causing the agent to select Mermaid when another format was desired, which is a security-relevant prompt-routing weakness in multi-skill environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Canvas skill uses generic triggers such as 'Canvas', 'mind map', and 'visual diagram', which can collide with everyday requests and with the other diagram skills listed in the same README. In practice, this broad scope can misroute user intent, trigger unintended file creation, or let crafted prompts steer the agent toward a less appropriate skill path.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The listed trigger phrases for the Excalidraw skill include very generic terms such as '画图', '流程图', and '思维导图', which are common in normal user requests and can cause the skill to activate outside narrowly intended contexts. In an agent skill system, overly broad activation increases the chance of unintended prompt injection surface expansion, incorrect tool selection, or undesired file generation when the user did not explicitly request this specific skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The Mermaid trigger list includes broad terms like '可视化' and '流程图', which are not unique to Mermaid and may match many unrelated requests. Because this repository contains multiple visualization skills with overlapping domains, ambiguous triggers can lead to accidental activation, misrouting, and increased exposure to untrusted input through the wrong skill path.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The Canvas trigger phrases include ambiguous expressions such as '思维导图' and '可视化图表', which are generic across multiple skills in the package. This weak scoping can cause unintended Canvas generation, especially when user intent was to request Mermaid or Excalidraw, leading to unexpected file creation and reduced control over agent behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description says to use the skill when users ask to "visualize concepts, create flowcharts, or make diagrams from text," which is broad and could match many ordinary requests outside a narrowly defined invocation context. It does not provide explicit trigger phrases, boundaries, or negative examples to clarify when this skill should or should not activate.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The instruction to "Default to process flow if ambiguous" permits activation or output selection even when the user's intent is unclear. This increases the chance of unintended behavior because ambiguity is resolved by assumption rather than by seeking clarification or applying stricter constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 68% confidence
Finding: The checklist states "No Emoji in any node text," which is a blanket output-format restriction expressed in natural language. While not a language mandate, it imposes a style constraint without user opt-in or justification, and may conflict with organizational expectations if user-preferred output conventions are meant to be preserved.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.