Mermaid Ascii Renderer

PassAudited by ClawScan on May 1, 2026.

Overview

This is a documentation-only skill for using a Mermaid-to-ASCII renderer, with no hidden code, credentials, persistence, or broad system access shown.

This appears safe as a documentation-only skill. Before installing the referenced beautiful-mermaid package, use a trusted package source and consider pinning the version for reproducible builds.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the package will run code from the package ecosystem when the user chooses to use it.

Why it was flagged

The skill recommends installing an external package without pinning a version. This is expected for a package-usage skill, but users should be aware of normal dependency provenance risk.

Skill content

npm install beautiful-mermaid
# 或
bun add beautiful-mermaid
# 或
pnpm add beautiful-mermaid

Recommendation

Install from the official package source, consider pinning a trusted version, and review the package repository if using it in a sensitive project.