Marp — Markdown Presentations

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:52 AM UTC
• Version: 1.0.0

Overview

This is a coherent Marp slide-authoring reference skill, with some normal but noteworthy tooling risks around third-party packages, remote scripts, and local-file/HTML rendering options.

Install only if you want Marp slide-generation help. When using it, prefer pinned local dependencies, avoid global npm installs where possible, pre-render diagrams for shared decks, and use --html or --allow-local-files only with trusted Markdown and trusted asset paths.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:155

Finding

Unpinned Global Installation of Executable Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 155–162
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Vulnerable Code:

bash

# Install mermaid CLI
npm install -g @mermaid-js/mermaid-cli

# Render .mmd files to SVG
mmdc -i diagram.mmd -o diagram.svg

# Reference in slides
# ![bg right:50%](diagram.svg)

Technical Analysis

The documented command installs the latest available version of @mermaid-js/mermaid-cli globally without an exact version, lockfile, or integrity verification. Package releases and their transitive dependencies can change after the Skill has been audited. If the package distribution channel, maintainer account, or a transitive dependency is compromised, installation lifecycle scripts or subsequently invoked package code could execute attacker-controlled instructions.

Global installation broadens the effect because the package is installed outside a project-scoped dependency environment and exposes the mmdc executable system-wide for the current user. The audited content does not demonstrate that this package is presently malicious; the confirmed issue is the unsafe dependency acquisition practice.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or a transitive dependency used by a future release.
2. A user follows the Skill and runs npm install -g @mermaid-js/mermaid-cli.
3. npm retrieves the compromised, unpinned release and may execute its installation lifecycle scripts.
4. Malicious code runs with the privileges of the user executing npm.
5. The globally installed mmdc command can also execute the malicious payload during later diagram-rendering operations.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that user's permissions and environment, the payload could access us ...[truncated 330 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @mermaid-js/mermaid-cli to a reviewed exact version rather than resolving the latest release.
• Install it as a project-local development dependency instead of globally:

  bash

  npm install --save-dev --save-exact @mermaid-js/mermaid-cli@REVIEWED_VERSION
  

• Commit and enforce a lockfile, and use npm ci in automated or reproducible environments.
• Invoke the locked local executable with:

  bash

  npx --no-install mmdc -i diagram.mmd -o diagram.svg
  

• Review transitive dependencies and installation lifecycle scripts before upgrades.
• Use package integrity verification and dependency scanning in CI.
• Run rendering in a sandbox or minimally privileged environment when processing untrusted diagrams.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:169

Finding

Runtime Retrieval and Execution of Remotely Hosted JavaScript

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 169–170
Vulnerability Type: Mutable remote payload retrieval and browser-side execution
Risk Level: Medium

Vulnerable Code:

html

<script type="module">
import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@10/dist/mermaid.esm.min.mjs';

Technical Analysis

The example instructs generated HTML presentations to import and execute JavaScript directly from a third-party CDN at runtime. The URL is pinned only to the major version 10, not to an immutable exact release or cryptographically verified artifact. Consequently, the effective JavaScript payload can change after the Skill and generated presentation have been reviewed.

Because ECMAScript module imports do not provide a subresource-integrity attribute at the import statement, the browser trusts the CDN response. A compromised upstream package, CDN account, distribution path, or mutable package release could therefore cause attacker-controlled JavaScript to execute whenever a user opens the generated HTML while network access is available.

The audited file contains no evidence that the current Mermaid CDN asset is malicious. The vulnerability is the runtime trust placed in mutable externally hosted executable content.

Attack Path

1. An attacker compromises the upstream Mermaid distribution, the CDN delivery path, or content selected by the mutable @10 version reference.
2. A presentation is generated using the documented module import.
3. A user opens the HTML presentation with network connectivity.
4. The browser downloads the current JavaScript response from the external CDN.
5. The compromised module executes in the presentation page's browser context.

Impact Assessment

The malicious module would obtain script execution within the origin and browser context used to open the presentation. It could alter slide content, capture information entered into the page, make ...[truncated 359 chars]

Remediation

View remediation

Remediation Suggestions

• Do not load executable presentation dependencies from a mutable runtime CDN URL.
• Download and review an exact Mermaid release, then bundle the JavaScript asset locally with the generated presentation.
• Pin all dependency and transitive-dependency versions using a lockfile.
• Verify downloaded artifacts against a trusted cryptographic digest before bundling them.
• Prefer the documented pre-rendered SVG approach for static presentations, especially for distribution to third parties.
• If remote assets are unavoidable, use an immutable versioned URL, apply a restrictive Content Security Policy, and serve presentations from an isolated origin with no sensitive same-origin data.
• Re-audit and update pinned assets through an explicit dependency-review process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Local (per slide, in HTML comments)

markdown

<!-- backgroundColor: #1a1a2e -->
<!-- color: white -->
<!-- class: lead -->
<!-- _class: invert -->   ← underscore prefix = this slide only (spot directive)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description says the skill triggers on broad phrases such as "presentation" and "export to PDF," plus "any Marp-related request." These terms overlap with common user requests outside this skill's intended scope and do not provide clear exclusion conditions, making accidental invocation more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example imports Mermaid from a public CDN at render/view time without warning about third-party code trust and network dependency. This can expose users to supply-chain risk, content integrity issues, privacy leakage, or non-reproducible builds when generating HTML slides.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly recommends --allow-local-files for PDF export without warning that this relaxes file-access restrictions for slide rendering. If users render untrusted markdown or image references, local file inclusion could expose sensitive local files into generated output or during rendering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill shows --html as a normal option without warning that enabling raw HTML increases attack surface in markdown rendering, especially when documents come from untrusted sources. Raw HTML can introduce unsafe embedded content, script-adjacent constructs, or renderer-specific abuse depending on output mode and downstream tooling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.