ClawHub
Back to skill

Security audit

Mermaid Image Uploader

Security checks for vulnerabilities and agentic risk

Overview

This skill does the advertised Mermaid conversion/upload work, but it can send diagram contents to third-party services by default and has under-disclosed privacy and generated-HTML safety risks.

Review this skill carefully before installing if your diagrams or Markdown may contain internal architecture, hostnames, customer data, credentials, or unreleased business details. Prefer a local mermaid-cli-only workflow for sensitive content, avoid the Markdown batch mode unless you want hosted image links, and treat generated HTML as active content that should not be opened from untrusted Mermaid input.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

other

Warning
Location
mermaid_converter.py:93
Finding

Mermaid Source Is Disclosed to Kroki During Default Conversion

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
mermaid_converter.py:134
Finding

Untrusted Mermaid Source Is Injected into Executable HTML Without Escaping

Content
View full analysis
Mermaid Diagram body {{ font-family: Arial, sans-serif; margin: 20px; background: #f5f5f5; }} .container {{ max-width: 1200px; margin: 0 auto; background: white; padding: 20px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }} h1 {{ color: #333; }} .mermaid {{ text-align: center; margin: 20px 0; }} .instructions {{ background: #e7f3ff; padding: 15px; border-radius: 4px; margin-bottom: 20px; }}

Diagram Preview

Instructions:
  1. Wait for diagram to render
  2. Right-click diagram -> "Save image as..."
  3. Or use screenshot tool
{mermaid_code}
""" with open(output_path, 'w', encoding='utf-8') as f: f.write(html_content) ``` ### Technical Analysis The `mermaid_code` value is inserted directly into an HTML document without HTML escaping or structural validation. An attacker-controlled input can terminate the `.mermaid` element and introduce arbitrary HTML, including script elements, event handlers, forms, iframes, and external res ...[truncated 1405 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
mermaid_converter.py:220
Finding

Predictable Shared Temporary Output Permits Symlink Overwrite and Conversion Races

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Dependency Instructions Recommend an Unpinned and Potentially Incorrect Package

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
image_host_uploader.py:27
Finding

Shared FreeImage API Credential Is Hard-Coded in Source

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (15)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file recommends Kroki online conversion as the preferred method but does not disclose that Mermaid source is sent to an external network service for rendering. This is dangerous because users may assume conversion is local and unknowingly expose proprietary or sensitive diagram content to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation promotes uploading generated Mermaid images to third-party image hosts without warning users that diagram content and resulting images will leave the local environment and be stored by external services. If users process internal architecture, credentials, URLs, or other sensitive content, this can cause unintended data disclosure to untrusted providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README encourages use of Kroki and multiple image-hosting services for converting and uploading Mermaid diagrams, but it does not warn users that diagram and possibly Markdown content will be sent to third-party services. This can expose sensitive architecture details, internal identifiers, or embedded secrets if users process private documentation, making the omission a real privacy and data-handling risk in this skill's context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly promotes uploading generated images to third-party hosting services but does not disclose that Mermaid content, rendered diagrams, filenames, or embedded sensitive information may be transmitted to external providers. In a documentation/content workflow, users may unknowingly publish internal architecture, credentials accidentally embedded in diagrams, or other sensitive material to public services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This function uploads a local file to a third-party image host and returns a public URL, but it provides no explicit user consent prompt, warning, or policy control around external disclosure. In an agent/skill context, that creates a real data-exfiltration risk if the caller passes sensitive local files or if users do not realize the image becomes available to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Postimages path transmits local image data to an external service without any user-facing disclosure or consent mechanism. Even though the behavior is functionally intended, it is dangerous because a skill can be invoked on sensitive screenshots or documents and silently publish them outside the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · image_host_uploader.py (reported line 89)May include surrounding context.

python
Image URL or None
        """
        try:
            url = "https://api.imgur.com/3/image"

            headers = {'Authorization': f'Client-ID {client_id}'}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Imgur upload sends both local file contents and an authorization header to a third-party service, again without explicit disclosure or confirmation. This increases risk because it not only exports local data but also uses credentials/tokens in the outbound request, which can have privacy and account-governance implications if used unexpectedly.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · mermaid_converter.py (reported line 20)May include surrounding context.

python
def check_mermaid_cli(self) -> bool:
        """Check if mermaid-cli is installed"""
        try:
            result = subprocess.run(
                ['mmdc', '--version'],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · mermaid_converter.py (reported line 63)May include surrounding context.

python
]

                # Execute conversion
                result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)

                if result.returncode == 0:
                    print(f"Converted successfully: {output_path}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This code sends the full Mermaid source to the third-party Kroki service over the network, which can expose sensitive diagram content, embedded credentials, internal architecture, or proprietary information. The risk is increased because the transmission occurs as part of normal conversion behavior without an explicit privacy warning, consent gate, or local-only default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The auto-selection logic tries Kroki first, meaning users who do not explicitly choose a method may unknowingly transmit diagram contents to an external service. In a skill context, diagrams often contain internal system topology, infrastructure details, or business logic, so making remote exfiltration the default materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The Markdown processing example states that Mermaid blocks will be replaced with image links, but it does not warn that this modifies file contents and may overwrite or materially transform source documentation. Users could unintentionally lose original Mermaid source in derived files or introduce externally hosted links into documents without realizing the persistence and integrity implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The module docstring states it is 'Designed for WeChat Official Account articles,' which ties the skill to a specific platform/locale context in natural language. Under the policy rule, locale- or platform-specific constraints should be clearly justified or offer user opt-in; this file does not present such a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description is written entirely in Chinese and explicitly targets WeChat public-account article workflows ("专为公众号文章设计"). This imposes a specific language and locale context in the skill metadata without indicating any user choice or broader language support.

Content

No source excerpt is available for this finding.