ClawHub
Back to skill

Security audit

generate mermaid diagrams

Security checks for vulnerabilities and agentic risk

Overview

This Mermaid diagram skill is purpose-aligned, but it needs Review because crafted file paths could make its scripts run unintended local commands.

Install only after the command-injection issues are fixed by using non-shell process calls with argument arrays, and prefer a pinned local Mermaid CLI dependency over global npm install. Until then, do not run the generator or validator on paths, directories, or filenames influenced by someone else, and avoid sudo-based npm installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate.mjs:125
Finding

OS Command Injection Through the Generator Output Path

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/validate.mjs:82
Finding

OS Command Injection Through the Validator Directory Path

Content
View full analysis
f.endsWith(".mmd")); for (const mmdFile of mmdFiles) { const mmdPath = path.join(diagramDir, mmdFile); ``` ### Technical Analysis The validator interpolates `mmdPath` and `testSvg` into a string-form `execSync()` call. Both values may contain attacker-controlled shell metacharacters: - `diagramDir` is supplied through `--dir`. - `mmdFile` comes from filenames present in the selected directory. Because the command is processed by a shell, neither filesystem existence checks nor the `.mmd` suffix filter prevents command injection. A malicious directory name or crafted `.mmd` filename can become executable shell syntax. The subsequent `unlinkSync()` operation does not mitigate the issue because command execution occurs first. ### Attack Path A direct exploitation path through the directory argument is: 1. An attacker creates or causes the Agent to use a directory whose name contains shell syntax. 2. The directory contains at least one `.mmd` file so the rendering check is reached. 3. The validator is invoked with the malicious directory: ```bash node scripts/validate.mjs \ --dir 'diagrams; touch /tmp/validator-command-injection; #' ``` 4. `path.join()` carries ...[truncated 1031 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/install-deps.sh:115
Finding

Mutable Global Dependency Installation Creates Supply-Chain Exposure

Content
View full analysis
= $MIN_MMDC_VERSION.0.0)" print_info "Upgrading to latest version..." npm install -g @mermaid-js/mermaid-cli@latest # Re-check version NEW_VERSION=$(mmdc --version 2>/dev/null | head -1 || echo "unknown") print_success "Upgraded to version $NEW_VERSION" exit 0 fi else print_info "mmdc not found. Installing..." fi ############################################################################### # Install mermaid-cli ############################################################################### print_info "Installing @mermaid-js/mermaid-cli globally..." echo "" if npm install -g @mermaid-js/mermaid-cli; then echo "" print_success "Installation successful" else echo "" print_error "Installation failed" echo "" echo "Troubleshooting:" echo " 1. Check npm permissions:" echo " npm config get prefix" echo " (Should be a writable directory)" echo "" echo " 2. Try with sudo (not recommended):" echo " sudo npm install -g @mermaid-js/mermaid-cli" echo "" echo " 3. Fix npm permissions (recommended):" echo " mkdir -p ~/.npm-global" echo " npm config set prefix ~/.npm-global" echo " echo 'export PATH=~/.npm-global/bin:\$PATH' >> ~/.bashrc" echo " source ~/.bashrc" echo " npm install -g @mermaid-js/mermaid-cli" ``` The package metadata also permits a mutable range: ```json "peerDependencies": { "@mermaid-js/mermaid-cli": "^11.0.0" } ``` ### Technical Analysis The installer retrieves Mermaid CLI from npm without pinning an exact audited version. One installation branch explicitly requests `@latest`, while another omits the version and therefore also resolves to the registry's current default release. Th ...[truncated 2129 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (17)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
node scripts/generate.mjs --content content.json --out diagrams/chapter-01

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
node scripts/generate.mjs --content content.json --out diagrams/chapter-01

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md
node scripts/generate.mjs --content content.json --out diagrams/chapter-01

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

md
node scripts/generate.mjs --content content.json --out diagrams/chapter-01

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.

md
node scripts/generate.mjs --content content.json --out diagrams/chapter-01

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 422)May include surrounding context.

md
node scripts/generate.mjs --content content.json --out diagrams/chapter-01

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json
"validate": "node scripts/validate.mjs",
    "test": "node scripts/run-semantic-tests.mjs && npm run test:render",
    "test:semantic": "node scripts/run-semantic-tests.mjs",
    "test:render": "node scripts/generate.mjs --content tests/all-templates-content.json --out test-output && node scripts/validate.mjs --dir test-output && rm -rf test-output",
    "install-deps": "./scripts/install-deps.sh"
  },
  "dependencies": {},

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/install-deps.sh (reported line 153)May include surrounding context.

sh
roubleshooting:"
  echo "  1. Check npm permissions:"
  echo "     npm config get prefix"
  echo "     (Should be a writable directory)"
  echo ""
  echo "  2. Try with sudo (not recommended):"
  echo "     sudo npm install -g @mermaid-js/mermaid-cli"
  echo ""
  echo "  3. Fix npm permissions (recommended):"
  echo "     mkdir -p ~/.npm-global"
  echo "     npm config set prefix ~/.npm-global"
  echo "     echo 'export PATH=~/.npm-global/bin:\$PATH' >> ~/.bashrc"
  echo "     source ~/.bashrc"
  echo "     npm install -g @mermaid-js/mermaid-cli"
  echo ""
  exit 1
fi

###############################################################################
# Verify Installation
###############################################################################

print_info "Verifying installation..."

if ! command -v mmdc &> /dev/null; then
  print_error "mmdc not found after installation"
  echo ""
  echo "Possible causes:"
  echo "  - npm global bin directory not in PATH"
  echo "  - Installation

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata includes very broad trigger phrases such as "generate diagram" and "technical illustration," which are generic enough to match many ordinary requests outside the intended Mermaid-specific workflow. This can cause unintended invocation of the skill, increasing the chance that it reads files, spawns subagents, or suggests running local scripts in contexts where the user did not explicitly ask for this capability.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

Add New Template

  1. Create assets/new-template.mmd with theme and placeholders
  2. Add entry to TEMPLATES object in scripts/generate.mjs:
javascript
const TEMPLATES = {

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install-deps.sh (reported line 62)May include surrounding context.

sh
echo ""
  echo "Please install Node.js >= 18.0.0:"
  echo "  - macOS: brew install node"
  echo "  - Ubuntu/Debian: sudo apt install nodejs npm"
  echo "  - Other: https://nodejs.org/"
  exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install-deps.sh (reported line 147)May include surrounding context.

sh
echo ""
  echo "Please install Node.js >= 18.0.0:"
  echo "  - macOS: brew install node"
  echo "  - Ubuntu/Debian: sudo apt install nodejs npm"
  echo "  - Other: https://nodejs.org/"
  exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install-deps.sh (reported line 148)May include surrounding context.

sh
echo ""
  echo "Please install Node.js >= 18.0.0:"
  echo "  - macOS: brew install node"
  echo "  - Ubuntu/Debian: sudo apt install nodejs npm"
  echo "  - Other: https://nodejs.org/"
  exit 1
fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install-deps.sh (reported line 151)May include surrounding context.

sh
echo "     sudo npm install -g @mermaid-js/mermaid-cli"
  echo ""
  echo "  3. Fix npm permissions (recommended):"
  echo "     mkdir -p ~/.npm-global"
  echo "     npm config set prefix ~/.npm-global"
  echo "     echo 'export PATH=~/.npm-global/bin:\$PATH' >> ~/.bashrc"
  echo "     source ~/.bashrc"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script builds a shell command by interpolating the user-controlled diagram path directly into execSync. Because args.dir influences mmdPath, a specially crafted directory or filename containing shell metacharacters could trigger command injection when the validator re-renders diagrams. In this skill context, the validator is meant to process generated diagram files, so it is plausible it may be run on untrusted or externally sourced paths, increasing practical risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

In the subagent usage example and description, the skill is told to read a chapter and save generated outputs to diagrams/chapter-01/, which is a file-system modifying action. The README describes the behavior but does not include any explicit warning or user-facing caution about creating or overwriting files in the destination directory.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
},
  "dependencies": {},
  "peerDependencies": {
    "@mermaid-js/mermaid-cli": "^11.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/generate.mjs:143

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/validate.mjs:84