Mermaid图表工具(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.3

Overview

This Mermaid diagram skill appears non-malicious, but it asks for broad file and command access that is not tightly scoped to diagram generation.

Install only if you are comfortable reviewing its actions. Prefer using it to generate Mermaid code in chat without granting shell or broad filesystem access, and avoid the optional global npm install unless you pin and trust the Mermaid CLI package in a controlled environment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:22

Finding

Excessive Tool Permissions for a Documentation-Only Diagram Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-25
Vulnerability Type: Violation of least privilege through unnecessary filesystem and command-execution capabilities
Risk Level: Medium

Vulnerable Code Snippet:

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The Skill's declared purpose is to convert natural-language descriptions into Mermaid source code. This core operation can be completed entirely within the model response and does not inherently require arbitrary command execution or general filesystem read and write access.

Declaring read, write, and especially exec creates capabilities substantially broader than the legitimate task requires. The document does not define path restrictions, command allowlists, approval requirements, or other controls that limit how these tools may be used. This increases the potential consequences of malicious user input, indirect prompt injection, or erroneous agent behavior.

The permission declaration does not itself prove that unauthorized commands will be executed. The vulnerability is the unnecessary exposure of privileged capabilities and the resulting failure to enforce least privilege.

Attack Path

1. The Skill is loaded by an agent that grants the tools declared in its metadata.
2. An attacker submits a crafted diagram request containing instructions designed to induce tool use.
3. The agent treats those instructions as part of the Skill workflow or otherwise fails to separate untrusted content from operational instructions.
4. The agent invokes read, write, or exec even though those tools are unnecessary for Mermaid text generation.
5. Depending on the agent sandbox and operating-system permissions, local files may be inspected or modified, or arbitrary local commands may be run.

Impact Assessment

Successful exploitation could provide access to files readable by the agent process, modification of f ...[truncated 536 chars]

Remediation

View remediation

Remediation Suggestions

• Remove read, write, and exec from the tool declaration because Mermaid source generation does not require them.
• Return generated Mermaid code directly in the model response rather than writing it to disk.
• If local export is later implemented, grant write access only to a user-selected output file or a dedicated sandbox directory.
• If rendering is later implemented, permit only a fixed Mermaid renderer executable with validated arguments rather than exposing a general shell.
• Require explicit user approval before any filesystem operation or local process execution.
• Treat diagram descriptions and labels as untrusted data and prohibit them from being interpreted as commands, paths, or agent instructions.
• Run optional rendering in a sandbox with minimal filesystem visibility, no unnecessary network access, and an unprivileged operating-system account.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:301

Finding

Unpinned Global Installation of a Third-Party Mermaid Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 301
Vulnerability Type: Unsafe third-party dependency installation practice
Risk Level: Low

Vulnerable Code Snippet:

shell

npm i -g @mermaid-js/mermaid-cli

Technical Analysis

The setup guidance recommends installing Mermaid CLI globally without pinning a reviewed version or verifying package integrity. npm installation may execute package lifecycle scripts from the selected package or its transitive dependencies. Because no version is specified, the command resolves whatever release is current when it is executed, so the installed code can differ from the code that existed when the Skill was audited.

The -g option also modifies the user's global Node.js environment rather than containing the dependency within the project. This increases the scope of package files and executable links created by the installation.

The package name is the expected official scoped name for Mermaid CLI. The audit found no evidence of typosquatting, dependency confusion, a malicious registry, or a known compromised release. The finding concerns the unpinned, globally scoped installation method rather than confirmed malicious behavior by the named package.

Attack Path

1. A user follows the optional installation instruction.
2. npm resolves the latest available package release and its transitive dependency graph at installation time.
3. Package contents and permitted lifecycle scripts execute with the privileges of the user running npm.
4. If the registry account, selected release, package distribution channel, or a transitive dependency has been compromised, attacker-controlled code can run during installation.
5. Global installation may place package files or executable links in shared user-level or system-level Node.js locations, depending on the npm configuration.

Impact Assessment

In a supply-chain compromise scenario, attacker-controlled install ...[truncated 580 chars]

Remediation

View remediation

Remediation Suggestions

• Clearly state that Mermaid CLI is unnecessary when the user only needs generated Mermaid source code.
• Prefer a project-local development dependency over a global installation.
• Pin an explicitly reviewed Mermaid CLI version rather than resolving the latest release dynamically.
• Commit and enforce a lockfile so transitive dependency versions and integrity hashes remain reproducible.
• Use the official npm registry explicitly and retain npm integrity verification.
• Disable package lifecycle scripts where operationally feasible, or review required scripts before allowing them.
• Run rendering under an unprivileged account in a sandbox with restricted filesystem and network access.
• Do not recommend running the installation command with administrator privileges.
• Periodically audit the pinned package and transitive dependencies for known vulnerabilities before updating.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation language is broad enough to trigger on many ordinary requests involving diagrams or visualization, which can cause the skill to activate outside its intended scope. Over-broad triggering is dangerous in agent systems because it can route unrelated tasks into a skill that has write/exec capabilities and ambiguous operational behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The capability table says '用户用中文描述时,生成中文标签', which imposes a language behavior based on input language rather than offering a user choice. The file does not indicate that users can opt for another output language or locale, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a Mermaid code generator, but its documentation expands into generic create/query/modify/delete/save/export behaviors via abstract parameter blocks. That mismatch increases the chance an agent will treat the skill as broadly operational rather than narrowly generative, enabling unintended file or system-affecting actions beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Advertising modify/delete/save/export operations together with exec usage, without clear warnings or guardrails, normalizes potentially system-affecting actions in what should be a low-risk content-generation skill. Users may not realize the skill could perform side-effecting operations, increasing the risk of unintended file changes or command execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Declaring exec capability for a diagram-generation skill violates least privilege unless shell access is narrowly justified and constrained. In an agent environment, unnecessary execution rights can be abused to run local commands unrelated to Mermaid generation or rendering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The rule '用户用中文描述时,生成中文标签' appears again as an instruction in the best-practices section, reinforcing a fixed locale behavior. Because no opt-in or alternative is described, the skill appears to prescribe language output instead of allowing user selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The API Key section presents the skill as Markdown-instruction based and not dependent on external APIs for local rendering. Later, the error handling and known limitations discuss network errors, ping-based connectivity testing, and network-dependent execution, which conflicts with the earlier no-external-API framing rather than merely omitting detail.

Content

No source excerpt is available for this finding.