Diagram基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:33 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent diagram generator, but it asks users to run an unpinned external MCP package and includes an unexplained callback URL option.

Review before installing. Use only if you trust the mcp-diagram-generator package source, pin a known reviewed version where possible, avoid passing sensitive diagram content to callback_url, and run the MCP server with limited filesystem and environment access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:140

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 140–145
Vulnerability Type: Unpinned and automatically downloaded third-party dependency
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "mcp-diagram-generator": {
      "command": "npx",
      "args": ["-y", "mcp-diagram-generator"]
    }
  }
}

The same unsafe command is recommended again in the configuration guidance at lines 278–282:

text

A: Add an `mcp-diagram-generator` entry to the Agent's MCP configuration,
set `command` to `npx`, and set `args` to
`["-y", "mcp-diagram-generator"]`.

Technical Analysis

The skill directs users to execute mcp-diagram-generator through npx without pinning an exact package version or verifying its integrity. Consequently, package resolution may select a newer release than the one reviewed when the skill was published.

The -y option automatically accepts installation, removing the interactive confirmation that would otherwise alert the user that external package code is being downloaded and executed. npm packages can execute lifecycle scripts during installation, and the resulting MCP server itself runs as executable code. Therefore, compromise of the package, its publication account, or its transitive dependencies could result in arbitrary code execution.

This finding does not establish that the named package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution model documented by the skill.

Attack Path

1. An attacker compromises the package publication account, a transitive dependency, or the relevant package supply chain.
2. The attacker publishes a malicious version under the package name used by the skill.
3. A user follows the documented configuration and starts the MCP server with npx -y mcp-diagram-generator.
4. npx resolves and downloads the unpinned package without requesting installation confirmation.
5. Malicious lifecycle or server code executes ...[truncated 832 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example:

   json

   {
     "mcpServers": {
       "mcp-diagram-generator": {
         "command": "npx",
         "args": ["--yes", "mcp-diagram-generator@1.2.3"]
       }
     }
   }
   

2. Prefer a locally installed dependency governed by a committed lockfile rather than downloading executable code when the MCP server starts.

3. Verify package provenance and integrity, including the official registry, publisher identity, release signatures or attestations where available, and expected package hashes.

4. Review both direct and transitive dependencies before approving upgrades. Use automated dependency and lockfile scanning in the release process.

5. Avoid silent installation where practical. If npx remains necessary, use controls that prevent unexpected version changes and registry substitution.

6. Run the MCP server in a sandbox or container with:

   • A minimal environment and no unrelated secrets.
   • Write access restricted to the intended diagram output directory.
   • Read access restricted to required project data.
   • Network access disabled or allowlisted when not required.
   • A dedicated unprivileged operating-system identity.

7. Document a trusted package source and a controlled upgrade procedure so reviewed versions are changed deliberately rather than resolved dynamically.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The display name, summary, and much of the skill documentation are presented only in Chinese, with no indication that users may choose another language or locale. If organizational policy requires avoiding forced language selection without user opt-in, this is a natural-language policy issue because the skill defaults to a single language experience.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description repeatedly says the skill is suitable for broad 'related development scenarios' and users can invoke it by providing 'input data or instructions', but it does not define concrete trigger phrases, scope boundaries for invocation, or negative examples. This ambiguity increases the chance of unintended activation because the invocation conditions overlap with generic development requests rather than narrowly scoped diagram-generation intents.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill documents a callback_url input even though the rest of the skill is framed as a local diagram-generation workflow. If implemented, this introduces an outbound network interaction that can exfiltrate generated content or user-supplied data to an attacker-controlled endpoint, and it is not clearly constrained, justified, or safety-warned in the skill. In this context, the mismatch between 'local file output' messaging and an unsolicited callback capability makes the feature more suspicious, not less.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill describes generating and saving files to disk but does not prominently warn the user about this side effect or require confirmation before writing. In agent environments, silent file creation can overwrite expected workspace state, create artifacts in repositories, or be chained with other tooling in ways the user did not intend. The context makes this more significant because the skill explicitly includes write and exec tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Earlier sections describe calling the MCP tool to generate a diagram file and returning a saved file path such as diagrams/mermaid/... or diagrams/drawio/.... The final output example instead shows a generic wrapper with result, execution_time, and metadata, which does not reflect the file-path-oriented behavior described elsewhere in the same document.

Content

No source excerpt is available for this finding.