Mermaid Image Uploader

Convert Mermaid diagrams to images, upload to free image hosts, and return image URLs for markdown files and single diagrams.

Security Scan

The skill mostly does what it says (convert Mermaid diagrams and upload images), but there are several inconsistencies and small red flags (hidden control characters in SKILL.md, an unexplained hardcoded API key, inaccurate install instructions, and documentation claiming support for Cloudinary although code doesn't implement it) that merit human review before installation.

Purpose & Capability

Name/description match the code: converter + uploader for multiple image hosts. Implemented hosts: FreeImage.host, Postimages, Imgur; conversion methods: Kroki, mermaid-cli, HTML. Minor incoherences: SKILL.md and README mention Cloudinary as supported (and show a table) but there is no Cloudinary implementation in image_host_uploader.py. The uploader contains a hardcoded public key value for FreeImage.host (data {'key': '6d207e02...'}) — plausible as a demo key but unexplained in docs. Overall capability set is consistent with the stated purpose, but the Cloudinary mention and the hardcoded key are unexplained and worth checking.

Instruction Scope

Runtime instructions are largely scoped to installing conversion dependencies and using the CLI/Python API. However: SKILL.md contains a detected 'unicode-control-chars' pattern (hidden/obfuscated characters) which can hide text or alter how instructions appear; this is unexpected and should be inspected. Also SKILL.md suggests 'pip install mermaid-cli requests' which is incorrect for mermaid-cli (the package is a Node tool @mermaid-js/mermaid-cli via npm / mmdc), indicating sloppy or incorrect instructions. The skill will send data (diagram images or compressed encoded diagrams via Kroki) to external services (kroki.io, freeimage.host, postimages.org, api.imgur.com) — this is expected for its purpose, but means uploaded diagrams are transmitted to third-party hosts (privacy consideration).

Install Mechanism

No install spec in registry (instruction-only), and the code itself does not download or execute remote installers. Dependencies are typical (requests, optional mermaid-cli). There is no use of remote arbitrary download/extract in an install script. The incorrect pip/npm guidance in docs is an implementation/documentation error but does not create an install-time code-execution rischio beyond normal dependency installation.

Credentials

The skill requests no environment variables or platform credentials. It uses a hardcoded FreeImage demo key in image_host_uploader.py and accepts an API key/client id parameter for Imgur via CLI/arguments. There are no unrelated credential requests (no AWS/GitHub tokens, etc.). The hardcoded key is questionable (why include a key in source?) and should be validated or removed; otherwise environment/credential access is proportional.

Persistence & Privilege

Registry flags: always=false, normal invocation allowed. The skill does not request persistent or elevated system privileges, does not modify other skills' configs, and does not attempt to enable itself permanently. No persistence or privilege escalation detected in the files.

Scan Findings in Context

[unicode-control-chars] unexpected: Hidden/unicode control characters were detected in SKILL.md. These are not necessary for a conversion/uploader guide and can be used to obfuscate text or inject hidden instructions. The file should be opened in a hex/visible-control-char viewer and the hidden characters removed or explained.

What to consider before installing

This skill appears to implement Mermaid-to-image conversion and uploaders and is mostly coherent with its description, but take these precautions before installing or running it: - Inspect SKILL.md and README for hidden control characters and remove them. The scanner found unicode control characters which can hide or obfuscate instructions. - Review and remove or explain the hardcoded FreeImage key in image_host_uploader.py — do not assume it's safe to keep or use for sensitive content. - Don't upload diagrams that contain secrets or private data: the tool transmits images (and via Kroki it sends compressed diagram content) to third-party services (kroki.io, freeimage.host, postimages.org, api.imgur.com), so uploaded content becomes visible to those services. - The docs contain an incorrect install command ('pip install mermaid-cli' is wrong) and mention Cloudinary support that isn't implemented; treat documentation as imperfect and verify dependencies (install @mermaid-js/mermaid-cli via npm if you need local mmdc). - If you want stronger assurance, run the code in an isolated environment or sandbox, monitor network calls when converting/uploading, and consider replacing/rotating the hardcoded key or using your own image-host credentials. If you want, I can list the exact lines where the hardcoded key and the unicode control characters appear, or produce a cleaned copy of SKILL.md and point out the Cloudinary references that don't match the code.

Mermaid 图片生成与图床上传技能

将 Mermaid 图表转换为图片并上传到免费图床，专为公众号文章设计。

功能特性

• 🎨 将 Mermaid 代码转换为高质量图片
• ☁️ 支持多个免费图床上传
• 🔗 自动返回图片 URL
• 📝 批量处理 Markdown 文件中的 Mermaid 图表
• 🖼️ 支持多种图片格式 (PNG, SVG, JPG)

快速开始

安装依赖

pip install mermaid-cli requests

或者安装 Node.js 的 mermaid-cli：

npm install -g @mermaid-js/mermaid-cli

使用方法

# 转换单个 Mermaid 文件
python mermaid_uploader.py --input diagram.mmd --output diagram.png

# 转换 Markdown 文件中的所有 Mermaid 图表
python mermaid_uploader.py --markdown article.md --upload

# 指定图床
python mermaid_uploader.py --input diagram.mmd --image-host imgur

支持的图床

图床	需要API Key	特点
Imgur	✅	稳定，国外
FreeImage.host	❌	免费，国内访问快
Postimages	❌	简单易用
Cloudinary	✅	功能强大

文件结构

skills/mermaid-image-uploader/
├── SKILL.md                    # 本文件
├── package.json                # 技能配置
├── README.md                   # 详细说明
├── mermaid_uploader.py         # 主程序
├── mermaid_converter.py        # Mermaid 转换器
├── image_host_uploader.py      # 图床上传器
└── examples/                   # 示例
    ├── sample_diagram.mmd
    └── sample_article.md

使用示例

1. 转换单个 Mermaid 图表

from mermaid_uploader import MermaidUploader

uploader = MermaidUploader()

# 转换并上传
url = uploader.convert_and_upload(
    mermaid_code="""
    graph LR
        A[开始] --> B[处理]
        B --> C[结束]
    """,
    image_host="freeimage"
)

print(f"图片URL: {url}")

2. 处理 Markdown 文件

from mermaid_uploader import MarkdownProcessor

processor = MarkdownProcessor()

# 处理文件，替换所有 Mermaid 为图片链接
processor.process_file("article.md", "article_with_images.md")

命令行参数

--input, -i      输入的 Mermaid 文件
--output, -o     输出的图片文件
--markdown, -m   处理的 Markdown 文件
--upload, -u     是否上传到图床
--image-host     指定图床 (imgur, freeimage, postimages)
--format, -f     输出格式 (png, svg, jpg)
--api-key        图床 API Key

欢迎关注

欢迎关注微信公众号：拿客

获取更多技术干货和开源工具分享！

许可证

MIT License