Mermaid Image Export

• Outcome: Review
• Latest audit: May 28, 2026 · 2:38 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent diagram-export purpose, but one batch helper can run arbitrary shell commands through an under-scoped command option.

Install only if you trust the skill and will use it in a controlled workspace. Avoid passing untrusted values to --mermaid-cmd, prefer direct mmdc usage, and do not follow no-sandbox or SELinux-disabling troubleshooting steps on a sensitive host unless you are in an isolated test or CI environment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Command: {' '.join(cmd)}")
    
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 92% confidence
• Finding: This subprocess execution uses a command derived from the user-controllable --mermaid-cmd option via mermaid_cmd.split(), allowing a caller to choose an arbitrary executable and arguments. Although shell=True is not used, an attacker can still cause execution of unintended local programs, which is dangerous in an agent skill context where tool parameters may be influenced by upstream prompts or untrusted inputs. The skill also renders untrusted Mermaid content through mermaid-cli/Puppeteer, increasing exposure to downstream renderer or browser bugs.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd):
    """Run a command and return (success, output)."""
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True, text=True, timeout=10
        )
        return result.returncode == 0, result.stdout.strip()

• Confidence: 93% confidence
• Finding: The helper uses subprocess.run with shell=True for all command execution, which is unsafe because any future or indirect influence over the command string can turn this into shell injection. In this file the current call sites are mostly hardcoded, so the immediate exploitability is limited, but the pattern is still dangerous and unnecessary in an installation script that executes system commands.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence
• Finding: The skill is presented as an image export helper, but its documented behavior also includes environment inspection and package installation via npm, including global install commands. That broader behavior increases the attack surface because installation steps execute external package-manager actions and modify the host environment, which may be unexpected for users invoking a seemingly simple export skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script accepts a user-controlled --mermaid-cmd value, concatenates it into a shell command string, and executes it with eval. That means an attacker can supply arbitrary shell syntax instead of a Mermaid CLI binary, leading to command execution far beyond the stated purpose of exporting diagrams.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The help text presents --mermaid-cmd as a way to choose the Mermaid CLI, but the implementation later treats the value as arbitrary shell input and executes it. This mismatch is dangerous because users may reasonably trust the option as limited-scope while it actually enables full command injection.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The troubleshooting guide recommends disabling Chromium/Puppeteer sandbox protections using --no-sandbox and --disable-setuid-sandbox, but it does not clearly warn that this materially reduces browser isolation and can increase the impact of malicious content or renderer compromise. Because this skill renders user-supplied Mermaid content through a headless browser, normalizing unsandboxed execution makes the guidance security-relevant rather than merely operational.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The SELinux section suggests sudo setenforce 0 as a troubleshooting step with only a brief note that it is not recommended for production, which understates the security consequence of disabling mandatory access controls. This can lead users to weaken host protections system-wide while diagnosing a diagram export problem.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Using eval on a command assembled from user-influenced values creates shell injection risk even if the feature was intended for convenience. In an agent skill context, this is more dangerous because automated workflows may pass through untrusted parameters or file names, turning a diagram export utility into a general command execution primitive.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The --mermaid-cmd option permits a user to supply the executable and arguments that will later be run by subprocess.run. Even without shell metacharacter injection, this is still arbitrary local program execution under the privileges of the script, which is especially risky for an agent skill that may process untrusted task inputs. The lack of strong warning, validation, or restriction makes accidental or malicious abuse more plausible.

Static analysis

No suspicious patterns detected.