ClawHub
Back to skill

Security audit

pretty-mermaid

Security checks for vulnerabilities and agentic risk

Overview

This diagram skill matches its stated purpose, but it needs review because installation changes global Node tooling and generated HTML can run unescaped or remote JavaScript.

Install only if you are comfortable with a global npm dependency and generated HTML that may contact a CDN. Avoid using untrusted Mermaid text with the HTML output path, do not host generated HTML on a sensitive origin, and prefer pinned local dependencies or SVG/PNG output when possible.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Warning
Location
scripts/install.sh:19
Finding

Unpinned Global Installation of Mermaid CLI

Content
View full analysis
Remediation
View remediation
``` 2. Prefer a project-local installation rather than `npm install -g`. 3. Commit a lockfile and use `npm ci` so dependency resolution is reproducible. 4. Review and pin transitive dependencies through the lockfile. 5. Verify npm provenance and package integrity before installation. 6. Run installation as an unprivileged user and explicitly warn users not to invoke the installer with `sudo`. 7. Update `SKILL.md` and `README.md` so they no longer recommend the unpinned global command. ]]>

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/mermaid-gen.py:253
Finding

Generated HTML Retrieves and Executes Remote JavaScript Without Integrity Verification

Content
View full analysis
``` ### Technical Analysis Each generated HTML diagram imports Mermaid JavaScript from a third-party CDN when the file is opened. Although the package version is present in the URL, the script element does not include a Subresource Integrity hash. The generated artifact is therefore not self-contained, and the executable code loaded by the browser remains dependent on the CDN and network delivery path after the Skill itself has been reviewed. If the CDN content or delivery path is compromised, the browser can execute altered JavaScript in the context of the generated page. The generated document also lacks a restrictive Content Security Policy that could constrain the behavior of the remote script. ### Attack Path 1. A user generates an HTML diagram through `mermaid-gen.py`. 2. The user opens the generated file while connected to the network. 3. The browser requests `mermaid.min.js` from `cdn.jsdelivr.net`. 4. A compromised CDN, upstream asset, or delivery path supplies modified JavaScript. 5. The browser executes the modified script in the generated document. 6. The script can manipulate the displayed document, deceive the user, initiate network requests permitted by the browser, and access information available to that document origin. ### Impact Assessment The immediate impact is arbitrary JavaScript execution within the generated page's browser context. This could enable content substitution, phishing, malicious redirection, or unauthorized network communication. If generated files are hosted under a trusted web origin rather than opened as isolated local files, the hostile script may also gain access to non-HttpOnly origin data and other resources ava ...[truncated 160 chars]
Remediation
View remediation
" crossorigin="anonymous"> ``` 3. Verify the integrity hash against a trusted release artifact before publishing it. 4. Add a restrictive Content Security Policy that only permits the required local or integrity-protected script. 5. Document that HTML output currently requires network access and executes third-party code. 6. Establish a controlled dependency-update process in which each new Mermaid build and integrity hash is reviewed. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mermaid-gen.py:333
Finding

Persistent HTML and JavaScript Injection Through Custom Mermaid Code

Content
View full analysis
{mermaid_code}

Mermaid Code:

text
{mermaid_code}
``` The resulting content is written directly to the selected output file: ```python with open(html_output, 'w', encoding='utf-8') as f: f.write(html_content) ``` The attacker-controlled value can be supplied through the command line: ```python parser.add_argument("--code", help="Custom Mermaid code (overrides --type)") ``` ### Technical Analysis The `--code` value is inserted into an HTML f-string without HTML escaping or safe serialization. Because it is embedded as raw markup, an attacker can terminate the surrounding element and inject arbitrary HTML, including executable `
``` The duplicate insertion inside `
text
` does not make the value safe because text inside these elements must still be HTML-escaped. The injection is persistent: the payload is stored in the generated HTML file and executes when that file is opened in a browser.

This path is especially relevant when Mermaid definitions originate from untrusted documents, chat content, issue descriptions, or other users and an agent passes that content through `--code`.

### Attack Path

1. An attacker prepares Merm
...[truncated 1384 chars]
Remediation
View remediation
` block: ```python import html displayed_code = html.escape(mermaid_code, quote=True) ``` 3. Place diagram source in a non-executable data representation, such as a safely JSON-serialized JavaScript value or an element populated through `textContent`. 4. Use a fixed container and assign the Mermaid source as text rather than through `innerHTML`. 5. Configure Mermaid with its strictest supported security mode and disable unsafe HTML labels or link behavior unless explicitly required. 6. Add a restrictive Content Security Policy that disallows inline scripts and event handlers. 7. Validate and contextually encode all styling arguments before inserting them into CSS or JavaScript. 8. Treat diagram input obtained from users, remote documents, tickets, or chat messages as untrusted. 9. Add regression tests using payloads containing closing tags, script tags, event handlers, and encoded markup. 10. Avoid silently falling back from an image output to active HTML when rendering fails; require explicit user approval or produce a non-executable error artifact instead. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises very broad activation conditions such as 'creating diagrams' and 'visualizing processes,' which can cause the skill to be invoked in many situations beyond Mermaid-specific requests. Over-broad routing increases the chance that an agent will unnecessarily load and use this skill, expanding attack surface and potentially causing unintended command execution or processing of untrusted diagram content in downstream scripts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs the agent to install packages globally, invoke shell commands, write files, and use tools that may access the network, but it does not declare any explicit tool scope or permissions. This creates a mismatch between documented behavior and declared safety boundaries, increasing the risk that an agent executes broader capabilities than a user or platform expects.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mermaid-gen.py (reported line 119)May include surrounding context.

python
def check_dependencies():
    """Check if mermaid-cli is installed."""
    try:
        subprocess.run(["mmdc", "--version"], capture_output=True, check=True)
        return True
    except (subprocess.CalledProcessError, FileNotFoundError):
        return False

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This skill's stated purpose is to generate styled Mermaid diagrams, but the implementation depends on invoking the external mmdc binary via subprocess. Spawning executables is a broader capability than the manifest suggests and is not justified unless explicitly declared as part of the skill's operating model.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mermaid-gen.py (reported line 216)May include surrounding context.

python
# Run command
        print(f"Generating diagram: {args.output}")
        result = subprocess.run(cmd, capture_output=True, text=True)
        
        if result.returncode != 0:
            print(f"Error generating diagram: {result.stderr}")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The generated HTML includes Mermaid from a public CDN, creating an undisclosed runtime dependency on a third-party remote script. Anyone opening the HTML may trigger network access and execute externally hosted JavaScript, which can leak metadata and expands the trust boundary beyond the local skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Fetching Mermaid from a public CDN without explicit warning means opening the generated file performs network requests and runs third-party JavaScript in the browser. In this skill context, that is more dangerous because users may reasonably expect a local diagram generator, not a network-enabled HTML artifact with external code dependencies.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The --output argument help states 'Output file path (PNG or SVG)', yet the code intentionally accepts and generates HTML outputs via --html and direct .html output handling. This documentation contradicts actual behavior and can mislead users about the skill's outputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.