PlantUML

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.1.1

Overview

This is a local PlantUML diagram helper with disclosed rendering and optional network-include behavior, with no evidence of hidden persistence, credential access, exfiltration, or destructive actions.

Install this if you need local PlantUML diagram rendering and are comfortable running PlantUML/Graphviz on diagram source you control. Review untrusted .puml files before rendering, and avoid or locally mirror the AWS/Azure/devicon URL includes in sensitive environments because they fetch mutable content from GitHub.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/stdlib-guide.md:125

Finding

Mutable Remote PlantUML Includes Permit Unreviewed Payload Retrieval

Content

View full analysis

Vulnerability Details

File Location: references/stdlib-guide.md:125-130, references/stdlib-guide.md:154-157, and references/stdlib-guide.md:170-174
Vulnerability Type: Remote PlantUML payload retrieval and supply-chain exposure
Risk Level: Medium

The guide provides ready-to-render examples that retrieve PlantUML source from mutable external GitHub locations.

AWS example (references/stdlib-guide.md:125-130):

plantuml

!define AWSPuml https://raw.githubusercontent.com/awslabs/aws-icons-for-plantuml/v18.0/dist
!include AWSPuml/AWSCommon.puml
!include AWSPuml/Compute/EC2.puml
!include AWSPuml/Database/RDS.puml
!include AWSPuml/NetworkingContentDelivery/CloudFront.puml
!include AWSPuml/NetworkingContentDelivery/ElasticLoadBalancing.puml

Azure example (references/stdlib-guide.md:154-157):

plantuml

!define AzurePuml https://raw.githubusercontent.com/plantuml-stdlib/Azure-PlantUML/release/2-9/dist
!include AzurePuml/AzureCommon.puml
!include AzurePuml/Compute/AzureAppService.puml
!include AzurePuml/Databases/AzureSQLDatabase.puml

Devicons example (references/stdlib-guide.md:170-174):

plantuml

!define DEVICONS https://raw.githubusercontent.com/tupadr3/plantuml-icon-font-sprites/master/devicons2
!include DEVICONS/python.puml
!include DEVICONS/postgresql.puml
!include DEVICONS/redis.puml
!include DEVICONS/nginx.puml

Technical Analysis

PlantUML processes remote !include content as part of the diagram source. Consequently, the effective input interpreted during rendering is not limited to the reviewed Skill package. The master and release-style references shown above are not pinned to verified commit hashes or protected by an integrity digest, so upstream content can change after the Skill has been audited.

If an upstream repository, maintainer account, release branch, or content-delivery path is compromised, an attacker could replace an expected ico ...[truncated 2472 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace remote examples with PlantUML's bundled local standard library wherever equivalent icons are available.
2. Vendor required icon libraries into a reviewed local directory and use local !include paths during rendering.
3. If remote retrieval is unavoidable, pin every dependency to a specific reviewed commit hash rather than master or a mutable release branch.
4. Download dependencies in a separate controlled acquisition step, verify an approved SHA-256 digest, and render only the verified local copy.
5. Run PlantUML with a restrictive security profile that disables URL access and unnecessary local-file access by default.
6. Block renderer network egress in sensitive or offline environments; allow it only through an explicit, audited opt-in workflow.
7. Update the examples so the secure local workflow is the default and move URL-based includes into a clearly marked advanced section.
8. Document the tested PlantUML version and keep the local JAR updated to address parser and preprocessing vulnerabilities.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly instructs use of shell commands (java -jar, python3, ls) but does not declare any permissions or allowed-tools scope. That creates an authorization and governance gap: an agent may invoke shell execution without an explicit least-privilege declaration, making review and policy enforcement harder.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

Rendering & Delivery Workflow

1. Write the .puml file to the workspace.
2. Render:

   bash

   java -jar ~/tools/plantuml.jar -tpng -charset UTF-8 <file>.puml
   

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render.py (reported line 38)May include surrounding context.

python

cmd.append("-v")
    cmd.append(str(puml_path))

    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"PlantUML error:\n{result.stderr}", file=sys.stderr)
        sys.exit(result.returncode)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs filesystem-affecting operations by reading the provided PlantUML source and causing PlantUML to create output files, but it provides only operational usage information rather than an explicit user-facing warning that files will be created in the source or specified output directory. Under the rule, file writes in code should have some visible disclosure; here the behavior is implicit but not clearly warned about.

Content

No source excerpt is available for this finding.