ISAI Mermaid Diagrams

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:01 AM UTC
• Version: 1.0.0

Overview

This diagram skill is mostly coherent, but it should go to Review because it sends full diagram contents to an external renderer without clear user consent and also implies local rendering.

Install only if users are comfortable with Mermaid diagram source being sent to mermaid.ink for rendering. Do not use it for confidential architecture, internal network topology, customer data, credentials, tokens, or regulated information unless the skill is changed to use a local renderer or require explicit consent before each upload.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:27
• Finding: Sensitive Diagram Data Is Disclosed to an External Rendering Service## Vulnerability Details **File Location**: `SKILL.md`, lines 27–34 and 55–60 **Vulnerability Type**: External Data Disclosure **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p /home/bcaddy/.openclaw/workspace/diagrams ENCODED=$(cat <input.mmd> | base64 -w 0) curl -s "https://mermaid.ink/img/${ENCODED}?bgColor=white&width=2048" \ -o /home/bcaddy/.openclaw/workspace/diagrams/<name>.png ``` The workflow repeats the same remote-rendering operation: ```bash ENCODED=$(cat /home/bcaddy/.openclaw/workspace/diagrams/<name>.mmd | base64 -w 0) curl -s "https://mermaid.ink/img/${ENCODED}?bgColor=white&width=2048" \ -o /home/bcaddy/.openclaw/workspace/diagrams/<name>.png ``` ### Technical Analysis The skill instructs the agent to embed the complete Mermaid source in a request to the third-party `mermaid.ink` rendering service. Base64 is reversible transport encoding and provides no confidentiality. Although HTTPS protects the request in transit, the rendering provider necessarily receives the encoded diagram and can decode its contents. Architecture and sequence diagrams commonly contain sensitive information such as internal hostnames, private IP ranges, service relationships, trust boundaries, security controls, database topology, authentication flows, and deployment details. The workflow includes no sensitivity review, redaction step, explicit disclosure warning, or informed user-consent requirement before transmitting this information. The documentation also states that diagrams are rendered with the local `mmdc` CLI while the actual prescribed workflow uses a remote service. This mismatch may cause users to incorrectly assume their diagram data remains local. This behavior does not retrieve or execute a remote payload, so it does not qualify as T03. The most accurate classification is an unlisted external data-disclosure event. ### Attack Path 1. A user requests a dia ...[truncated 1331 chars]
• Remediation: ## Remediation Suggestions 1. Use a locally installed, version-pinned, and audited Mermaid CLI or isolated container as the default renderer. 2. Remove remote rendering from the automatic workflow. If it must remain available, make it an explicit opt-in mode. 3. Before any external transmission, clearly inform the user that the complete diagram source will leave the local environment and identify the destination service. 4. Require explicit user consent for each remote rendering operation involving non-public content. 5. Add a sensitivity review and redaction step for internal hostnames, IP addresses, credentials, tokens, customer data, and proprietary system details. 6. Do not send secrets or regulated data to a public renderer under any circumstances. 7. Document the external provider's privacy, retention, and data-processing implications. 8. Correct the documentation so that it accurately distinguishes local `mmdc` rendering from remote `mermaid.ink` rendering. 9. If remote rendering is approved organizationally, restrict outbound traffic to an approved endpoint and validate the response type and status before treating the output as a PNG.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger phrases are broad enough to activate on many ordinary requests involving drawing or diagrams, increasing the chance the skill runs in contexts the user did not intend. In this skill, that matters because activation can lead to automatic creation and remote transmission of potentially sensitive technical content to a third-party service.

Credential Access

High

• Category: Privilege Escalation

Content

User->>Auth: Credentials + approval
    Auth-->>App: Authorization code
    App->>Auth: Token request\n(code, client_secret)
    Auth-->>App: Access token + refresh token
    App->>API: API request\n(Bearer token)
    API->>Auth: Validate token
    Auth-->>API: Token valid + claims

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill advertises Mermaid-based PNG generation in a way that suggests local rendering, but the actual workflow base64-encodes the diagram and sends it to the external mermaid.ink service. This creates a documentation/behavior mismatch that can cause unintended data disclosure when users include internal architecture, network topology, API flows, or authentication details in diagrams.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill directs the agent to use network access to transmit diagram source to a third-party renderer even though PNG generation can be performed locally. Because architecture and sequence diagrams often contain sensitive infrastructure and security design details, unnecessary outbound transmission increases confidentiality risk without a strong functional need.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions send the full diagram contents to mermaid.ink without an explicit warning that data will be transmitted off-box. Since the described use cases include network topology, auth flows, CI/CD, and database flows, users may unknowingly expose confidential design and security information to an external service.

Static analysis

No suspicious patterns detected.