T08 · Insecure Dependencies
Warning
- Location
scripts/convert_mermaid.py:96- Finding
Unpinned Mermaid CLI Package May Be Downloaded and Executed Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
Mermaid Workflow Skill
Security checks for vulnerabilities and agentic risk
Overview
This Mermaid diagram skill is mostly aligned with its stated purpose, but it needs review because it weakens browser sandboxing and can execute an unpinned npm package.
Review before installing. Prefer a pinned, locally installed Mermaid CLI with a lockfile, remove or disable the automatic npx fallback, and avoid Chromium --no-sandbox rendering unless inside a disposable isolated container or VM. Treat Mermaid files from others as untrusted, back up Markdown files before insertion, and avoid sudo/root for normal operation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/convert_mermaid.py:32- Finding
Puppeteer Configuration Disables Chromium Sandbox Protections
- Content
View full analysis
puppeteer-config.json << EOF { "args": ["--no-sandbox", "--disable-setuid-sandbox"] } EOF python3 ../scripts/convert_mermaid.py \ --input example_roadmap.mmd \ --output example_roadmap.png \ --puppeteer-config puppeteer-config.json ``` ### Technical Analysis The configuration supplies both `--no-sandbox` and `--disable-setuid-sandbox` to Chromium through Puppeteer. These flags disable Chromium's primary process-isolation controls. Mermaid rendering processes diagram definitions in a browser environment. If an attacker can influence an `.mmd` file and exploit a vulnerability in Mermaid, Chromium, Puppeteer, or another rendering component, disabling the sandbox removes an important containment boundary. A renderer vulnerability is still required for host code execution; Mermaid text alone is not shown by the audited code to provide direct operating-system command execution. The unsafe configuration is not merely documented as an exceptional workaround. It is generated by the conversion utility when requested, included as a project example, and used by the quick-start workflow. ### Attack Path 1. An attacker supplies or modifies a Mermaid `.mmd` file that will be rendered by the Skill. 2. The user invokes convers ...[truncated 1077 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README recommends disabling the browser sandbox via Puppeteer config without prominently warning that this removes a major security boundary. Because Mermaid rendering relies on a browser engine, disabling sandboxing can substantially increase host compromise risk if crafted diagram content, browser bugs, or untrusted assets are involved.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language instructions throughout the file are presented exclusively in Chinese, which can functionally force a language choice on users. The file does not offer an alternative language, opt-in behavior, or explain that the skill is intentionally region-specific, so this appears to violate the language/locale policy criterion.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file instructs users to run
insert_to_md.pyto insert content intoreport.md, which is a file-write operation affecting user data. The README presents the command as routine usage but does not include any warning about modifying the target file, replacing placeholders, or recommending a backup/review before execution.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README explicitly documents running an external CLI and pairing it with a Puppeteer configuration that disables Chromium sandbox protections. While invoking
mmdcis aligned with the skill's stated purpose, normalizing sandbox disabling lowers isolation for browser-rendered content and increases the blast radius if Mermaid input or browser components are malicious.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs users to configure Puppeteer/Chromium with
--no-sandboxand--disable-setuid-sandboxto work around launch issues, but does not warn about the security tradeoff. Disabling the browser sandbox weakens a key containment boundary, making malicious Mermaid content, renderer bugs, or compromised dependencies more dangerous during rendering.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document's headings, instructions, and examples are all presented in Chinese, which can amount to a forced language choice when no alternative language option or opt-in is provided. The file does not indicate that the skill is intentionally region-specific or that users may select another language.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
问题3: 中文显示问题
bash # 安装中文字体（Ubuntu） sudo apt-get install fonts-wqy-zenhei # 或在mmdc命令中指定字体 mmdc --fontFamily "WenQuanYi Zen Hei"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
问题3: 中文显示问题
bash # 安装中文字体（Ubuntu） sudo apt-get install fonts-wqy-zenhei # 或在mmdc命令中指定字体 mmdc --fontFamily "WenQuanYi Zen Hei"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
问题3: 中文显示问题
bash # 安装中文字体（Ubuntu） sudo apt-get install fonts-wqy-zenhei # 或在mmdc命令中指定字体 mmdc --fontFamily "WenQuanYi Zen Hei"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's comments, prompts, and status messages are entirely in Chinese, including user-facing interaction such as the continuation prompt at L021. For a general quick-start skill, this imposes a specific language on users without opt-in or documented regional justification, which matches the language/locale policy violation criteria.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The script recommends running Mermaid CLI via npx without pinning a specific version, which can fetch whatever package version is current at execution time. This creates a supply-chain risk: a compromised upstream release or breaking change could lead to unexpected code execution or unsafe behavior on the user's machine.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and all visible CLI messages are written in Chinese, which imposes a specific language on users. The file does not offer any language/locale option or indicate that this tool is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_mmdc_installed(): """检查mmdc是否安装""" try: result = subprocess.run(['mmdc', '--version'], capture_output=True, text=True) if result.returncode == 0: version = result.stdout.strip()
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The generated Puppeteer config disables Chromium sandbox protections via --no-sandbox and --disable-setuid-sandbox. Because the tool renders potentially untrusted Mermaid input through a browser-based engine, removing sandbox isolation significantly increases the impact of any browser or renderer compromise, potentially enabling arbitrary code execution or host access.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"执行命令: {' '.join(cmd)}") try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode == 0: print(f"✅ Mermaid图表已转换为PNG: {output_file}")
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The script explicitly falls back to invoking npx for @mermaid-js/mermaid-cli without a pinned version. That means code may be downloaded and executed at runtime from npm or another configured source, creating a meaningful supply-chain risk and making behavior non-reproducible and attacker-influenceable.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 94% confidence
- Finding
Falling back to npx @mermaid-js/mermaid-cli executes a package that is not pinned to a specific version, which can fetch and run whatever version is currently published or resolved in the environment. In a hostile or compromised registry, mirror, or local npm configuration, this creates a software supply-chain execution path that can lead to arbitrary code execution under the user's privileges.
- Content
python cmd[0] = 'npx' cmd.insert(1, '@mermaid-js/mermaid-cli') result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode == 0: print(f"✅ 使用npx转换成功: {output_file}") return True
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language docstrings and CLI help/output text entirely in Chinese, beginning with the module description. The policy allows locale constraints only when the skill offers opt-in choice or clearly documents a justified regional requirement, neither of which is present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code writes directly back to the user-supplied Markdown file, replacing its contents in place. Although the script prints status messages after the fact, there is no confirmation prompt, backup step, or prior warning in comments/docstrings that the original file will be overwritten.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
In batch mode, the script rewrites the target Markdown file after replacing placeholders, which can alter substantial document content. The code logs completion afterward, but does not provide a prior warning, confirmation prompt, or inline documentation describing this overwrite behavior.
- Content
Static analysis
No suspicious patterns detected.