图表生成工具-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.2

Overview

This Mermaid diagram skill is not malicious, but it needs Review because it grants command and browser capability while giving broad, inconsistent instructions beyond diagram generation.

Review before installing. Use it only for Mermaid diagram creation or editing, avoid letting it run commands except for an explicit export request, and prefer a pinned local mermaid-cli dependency with a lockfile instead of unpinned npx or global npm install. Do not treat its generic API, browser, or information-retrieval claims as necessary for normal diagram work.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:196

Finding

Unpinned Mermaid CLI Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 196, 254, and 280
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

At line 196:

bash

npx @mermaid-js/mermaid-cli -i diagram.mmd -o diagram.png

At line 254:

text

A: Use the `mermaid-cli` tool: `npx @mermaid-js/mermaid-cli -i input.mmd -o output.png`.

At line 280:

text

| mermaid-cli | Optional tool | No | `npm install -g @mermaid-js/mermaid-cli` |

Technical Analysis

The documented npx command identifies @mermaid-js/mermaid-cli without an exact version. Depending on the local npm configuration and cache state, npx can retrieve the current package release and execute its command. The global installation instruction is likewise unpinned.

As a result, the code executed during image export is not immutable relative to the reviewed Skill. The effective package and transitive dependency graph can change after this audit. If a future upstream release, maintainer account, package publication process, or transitive dependency is compromised, invoking the documented command could execute altered code locally.

The package name is consistent with the stated Mermaid-export functionality, and the reviewed file contains no evidence that the package is currently malicious. The risk arises from executing an unpinned, remotely retrieved dependency rather than from a confirmed malicious payload.

Attack Path

1. A user or agent follows the Skill instructions to export a Mermaid diagram as an image.
2. The agent invokes npx @mermaid-js/mermaid-cli or globally installs the package without selecting an audited version.
3. npm resolves the package and its dependency tree at execution or installation time.
4. If the resolved release or one of its dependencies has been compromised, malicious package code executes during installation or CLI invocation.
5. That code operate ...[truncated 854 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @mermaid-js/mermaid-cli to an exact, reviewed version rather than relying on the latest available release:

   bash

   npm install --save-dev --save-exact @mermaid-js/mermaid-cli@<audited-version>
   

2. Commit and enforce a lockfile, then use a reproducible installation command such as:

   bash

   npm ci
   

3. Invoke the locally installed binary without permitting npx to download missing packages:

   bash

   npx --no-install mmdc -i diagram.mmd -o diagram.png
   

   Alternatively, invoke ./node_modules/.bin/mmdc directly.

4. Remove the global installation recommendation. Keep the dependency isolated to the project or to a disposable export environment.

5. Run Mermaid rendering in a restricted sandbox or container with:

   • No unnecessary secrets in environment variables.
   • Minimal filesystem permissions.
   • Restricted outbound network access.
   • A non-privileged user.
   • Resource and execution-time limits.

6. Review the pinned package and lockfile periodically using dependency auditing and provenance or integrity verification mechanisms.

7. Limit the Skill's exec permission to explicit image-export requests. Mermaid text generation and editing should not require shell execution.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description uses very broad activation language covering AI model calls, intelligent dialogue, agent orchestration, and LLM applications, far beyond diagram generation. Overbroad routing criteria can cause the skill to be selected in unrelated contexts, where its exec and other capabilities may be exposed unnecessarily, increasing the risk of misuse or privilege expansion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description states '支持中文交互' and the document heavily frames usage in Chinese, which can imply a language-default constraint without making user choice explicit. The policy requires offering language or locale choice unless a justified constraint exists.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes browser and network-oriented behavior even though its stated purpose is local Mermaid diagram generation and editing. Unnecessary network capability expands the attack surface by enabling external fetching, data exfiltration, or remote content influence in a tool that should be largely offline and deterministic.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The capability coverage section enumerates broad scene keywords rather than specific task boundaries, which can make automated routing or human operators treat the skill as generally applicable. In the presence of exec, read, and browser, ambiguous activation conditions increase the chance that the skill is invoked with unnecessary privileges on unrelated tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs use of npx @mermaid-js/mermaid-cli without pinning an exact version, which makes execution depend on the latest package published at runtime. If the upstream package or one of its dependencies is compromised, the agent could fetch and execute attacker-controlled code via the allowed exec capability.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This is the same unpinned runtime package execution pattern repeated in the dependency section. Because the skill advertises command execution and local tool installation, it normalizes fetching and running mutable third-party code during use, increasing supply-chain exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill claims it is pure Markdown-driven and requires no extra API key, yet elsewhere describes API integration and HTTPS external communication. These contradictions obscure the real trust boundary and may mislead users or orchestration systems into approving a skill that can reach external services or process remote data unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest frames the skill as a narrow Mermaid diagram tool, but later sections claim broad capabilities such as API integration, information retrieval, and generic command execution. This scope drift can cause an agent or operator to grant or invoke capabilities beyond what users would reasonably expect, increasing the chance of unintended file, network, or command actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.