PlantUML

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.1.1

Overview

This is a local PlantUML diagram helper with disclosed rendering and optional network-include behavior, with no evidence of hidden persistence, credential access, exfiltration, or destructive actions.

Install this if you need local PlantUML diagram rendering and are comfortable running PlantUML/Graphviz on diagram source you control. Review untrusted .puml files before rendering, and avoid or locally mirror the AWS/Azure/devicon URL includes in sensitive environments because they fetch mutable content from GitHub.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/stdlib-guide.md:125
• Finding: Mutable Remote PlantUML Includes Permit Unreviewed Payload Retrieval## Vulnerability Details **File Location**: `references/stdlib-guide.md:125-130`, `references/stdlib-guide.md:154-157`, and `references/stdlib-guide.md:170-174` **Vulnerability Type**: Remote PlantUML payload retrieval and supply-chain exposure **Risk Level**: Medium The guide provides ready-to-render examples that retrieve PlantUML source from mutable external GitHub locations. AWS example (`references/stdlib-guide.md:125-130`): ```plantuml !define AWSPuml https://raw.githubusercontent.com/awslabs/aws-icons-for-plantuml/v18.0/dist !include AWSPuml/AWSCommon.puml !include AWSPuml/Compute/EC2.puml !include AWSPuml/Database/RDS.puml !include AWSPuml/NetworkingContentDelivery/CloudFront.puml !include AWSPuml/NetworkingContentDelivery/ElasticLoadBalancing.puml ``` Azure example (`references/stdlib-guide.md:154-157`): ```plantuml !define AzurePuml https://raw.githubusercontent.com/plantuml-stdlib/Azure-PlantUML/release/2-9/dist !include AzurePuml/AzureCommon.puml !include AzurePuml/Compute/AzureAppService.puml !include AzurePuml/Databases/AzureSQLDatabase.puml ``` Devicons example (`references/stdlib-guide.md:170-174`): ```plantuml !define DEVICONS https://raw.githubusercontent.com/tupadr3/plantuml-icon-font-sprites/master/devicons2 !include DEVICONS/python.puml !include DEVICONS/postgresql.puml !include DEVICONS/redis.puml !include DEVICONS/nginx.puml ``` ### Technical Analysis PlantUML processes remote `!include` content as part of the diagram source. Consequently, the effective input interpreted during rendering is not limited to the reviewed Skill package. The `master` and release-style references shown above are not pinned to verified commit hashes or protected by an integrity digest, so upstream content can change after the Skill has been audited. If an upstream repository, maintainer account, release branch, or content-delivery path is compromised, an attacker could replace an expected ico ...[truncated 2472 chars]
• Remediation: ## Remediation Suggestions 1. Replace remote examples with PlantUML's bundled local standard library wherever equivalent icons are available. 2. Vendor required icon libraries into a reviewed local directory and use local `!include` paths during rendering. 3. If remote retrieval is unavoidable, pin every dependency to a specific reviewed commit hash rather than `master` or a mutable release branch. 4. Download dependencies in a separate controlled acquisition step, verify an approved SHA-256 digest, and render only the verified local copy. 5. Run PlantUML with a restrictive security profile that disables URL access and unnecessary local-file access by default. 6. Block renderer network egress in sensitive or offline environments; allow it only through an explicit, audited opt-in workflow. 7. Update the examples so the secure local workflow is the default and move URL-based includes into a clearly marked advanced section. 8. Document the tested PlantUML version and keep the local JAR updated to address parser and preprocessing vulnerabilities.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill explicitly instructs use of shell commands (`java -jar`, `python3`, `ls`) but does not declare any `permissions` or `allowed-tools` scope. That creates an authorization and governance gap: an agent may invoke shell execution without an explicit least-privilege declaration, making review and policy enforcement harder.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Rendering & Delivery Workflow

1. Write the `.puml` file to the workspace.
2. Render:
   ```bash
   java -jar ~/tools/plantuml.jar -tpng -charset UTF-8 <file>.puml

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.append("-v")
    cmd.append(str(puml_path))

    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"PlantUML error:\n{result.stderr}", file=sys.stderr)
        sys.exit(result.returncode)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code performs filesystem-affecting operations by reading the provided PlantUML source and causing PlantUML to create output files, but it provides only operational usage information rather than an explicit user-facing warning that files will be created in the source or specified output directory. Under the rule, file writes in code should have some visible disclosure; here the behavior is implicit but not clearly warned about.

Static analysis

No suspicious patterns detected.