AI Mermaid Diagrams

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

This diagram skill does its stated job, but it can send sensitive architecture or auth-flow diagram contents to a third-party renderer without clear consent and has inconsistent local-vs-remote rendering disclosure.

Review before installing. Use this only for diagrams that are safe to send to mermaid.ink, or require a local renderer instead. Avoid using it for internal network maps, cloud account details, auth flows, private hostnames, IP ranges, credentials, customer data, or confidential system designs unless the user explicitly accepts that disclosure.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27
• Finding: External Disclosure of Mermaid Diagram Source Through URL-Based Rendering## Vulnerability Details **File Location**: `SKILL.md`, lines 27–32 and 57–63 **Vulnerability Type**: Sensitive information exposure to a third-party rendering service **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash mkdir -p /home/bcaddy/.openclaw/workspace/diagrams ENCODED=$(cat <input.mmd> | base64 -w 0) curl -s "https://mermaid.ink/img/${ENCODED}?bgColor=white&width=2048" \ -o /home/bcaddy/.openclaw/workspace/diagrams/<name>.png ``` The same unsafe rendering pattern is repeated later: ```bash ENCODED=$(cat /home/bcaddy/.openclaw/workspace/diagrams/<name>.mmd | base64 -w 0) curl -s "https://mermaid.ink/img/${ENCODED}?bgColor=white&width=2048" \ -o /home/bcaddy/.openclaw/workspace/diagrams/<name>.png ``` ### Technical Analysis The Skill directs the Agent to Base64-encode the complete Mermaid source and place it in the path of an HTTPS GET request sent to `mermaid.ink`. Base64 provides no confidentiality and can be trivially decoded by the rendering provider or any system retaining the URL. Diagram source may contain internal hostnames, private IP ranges, network segmentation, database locations, identity providers, authentication flows, service relationships, or other sensitive architectural information. URL paths may be retained in renderer access logs, reverse-proxy logs, observability platforms, network security products, and intermediary systems. The workflow does not require informed user consent, warn that source content is disclosed to a third party, classify or redact sensitive content, or provide a local-rendering default. ### Attack Path 1. A user requests a diagram containing confidential infrastructure or security-design information. 2. The Agent writes those details into a local `.mmd` file. 3. The prescribed command reads and Base64-encodes the complete file. 4. The encoded source is embedded directly into a request URL. 5. `curl` sends th ...[truncated 862 chars]
• Remediation: ## Remediation Suggestions 1. Use a locally installed, version-pinned Mermaid CLI as the default renderer so diagram source does not leave the environment. 2. If remote rendering remains available, require explicit informed consent immediately before transmission and clearly identify the destination service and data being sent. 3. Scan and redact credentials, tokens, private keys, internal hostnames, private addresses, account identifiers, and sensitive topology before external submission. 4. Avoid embedding source in a GET URL. Use an appropriately secured request body where supported, while recognizing that this does not remove the third-party disclosure risk. 5. Document the renderer's privacy, retention, logging, and data-processing assumptions. 6. Provide a configuration option that prohibits all external rendering for confidential environments. 7. Fail safely if local rendering is unavailable rather than silently falling back to a remote service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

User->>Auth: Credentials + approval
    Auth-->>App: Authorization code
    App->>Auth: Token request\n(code, client_secret)
    Auth-->>App: Access token + refresh token
    App->>API: API request\n(Bearer token)
    API->>Auth: Validate token
    Auth-->>API: Token valid + claims

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to activate on common requests like 'draw' or 'create a diagram,' increasing the chance the skill runs in contexts the user did not specifically intend. In this skill, accidental activation is more dangerous because execution may transmit sensitive diagram content to an external service.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documentation states rendering uses the `mmdc` CLI, but the operative commands use `curl` to a third-party renderer. This mismatch can cause operators to approve or invoke the skill under the false assumption that processing stays local, undermining informed consent and security review.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill claims local PNG generation but actually instructs uploading the full Mermaid source to the external mermaid.ink service. Mermaid diagrams often encode sensitive architecture, network topology, auth flows, or internal system details, so this creates an undisclosed data exfiltration path and misleading trust boundary for users.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill instructs sending diagram contents to an external rendering service without any explicit warning, consent step, or sensitivity check. Because the intended use includes architecture, auth, CI/CD, and data-flow diagrams, the transmitted content may reveal confidential internal design information to a third party.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The C4 context diagram includes components and relationships showing firm-wide usage event capture, telemetry reads, and prompts sent to an external LLM provider. In a markdown file, these behaviors should be accompanied by a warning when they could affect user data or privacy, but this section presents them as architecture examples without any disclosure or cautionary note.

Static analysis

No suspicious patterns detected.