Code To Mindmap

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:25 AM UTC
• Version: 1.0.1

Overview

This skill is a code-visualization guide with an optional Mermaid renderer; the main risks are ordinary setup and privacy cautions, not hidden malicious behavior.

Before installing or using the optional renderer, prefer a trusted local Mermaid CLI, pin or lock npm dependencies where possible, and avoid pasting diagrams derived from private code into mermaid.live unless the content is approved and sanitized.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:5

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/setup.sh:5 and scripts/render.py:41
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

scripts/setup.sh:5:

bash

echo "For PNG/SVG rendering, install mmdc: npm install -g @mermaid-js/mermaid-cli"

scripts/render.py:41:

python

print(f"   Install mmdc: npm install -g @mermaid-js/mermaid-cli")

Technical Analysis

The project instructs users to install @mermaid-js/mermaid-cli globally without specifying a reviewed version or verifying package integrity. Consequently, npm resolves the mutable version associated with the registry's current default distribution tag.

npm packages can execute lifecycle scripts during installation. If the package, one of its transitive dependencies, the selected registry, or the relevant publisher account is compromised, installation could execute attacker-controlled code. Global installation also expands the change scope by placing package executables and files in the user's global Node.js environment.

No evidence indicates that the named package is currently malicious. The vulnerability is the unsafe, non-reproducible dependency installation practice and the resulting exposure to future supply-chain compromise.

Attack Path

1. An attacker compromises an upstream package release, transitive dependency, publisher account, or npm distribution channel.
2. The attacker publishes a malicious version selected by npm's default distribution tag.
3. A user follows the documented npm install -g @mermaid-js/mermaid-cli instruction.
4. npm downloads the mutable package version and its transitive dependencies.
5. Malicious lifecycle code executes during installation with the permissions of the user running npm.
6. The compromised package may also install a globally accessible executable that runs later when the renderer invokes mmdc.

Impac

...[truncated 443 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @mermaid-js/mermaid-cli to a specifically reviewed version rather than relying on the latest distribution tag.
2. Use a project-local package.json and lockfile with recorded integrity hashes instead of recommending global installation.
3. Install with a clean, trusted npm registry configuration and verify the lockfile in version control.
4. Run the renderer in a container or another restricted environment with minimal filesystem and network access.
5. Avoid running npm installation commands with sudo, administrator rights, or other elevated privileges.
6. Add an update process that reviews release notes and dependency changes before changing the pinned version.
7. Update all documentation and runtime messages so they consistently provide the hardened installation command.

other

Warning

• Location: scripts/render.py:37

Finding

Potential Disclosure of Source-Derived Data to an External Mermaid Playground

Content

View full analysis

Vulnerability Details

File Location: scripts/render.py:37-42
Vulnerability Type: User-mediated disclosure of potentially sensitive source-derived content
Risk Level: Medium

Vulnerable Code

python

print(f"⚠️  mermaid-py requires a running server. Try: mmdc CLI or https://mermaid.live")
print(f"   Quick alternative: copy contents of {mmd_path} to https://mermaid.live")
except ImportError:
    print(f"ERROR: No Mermaid renderer found.")
    print(f"   Install mmdc: npm install -g @mermaid-js/mermaid-cli")
    print(f"   Or visit: https://mermaid.live, paste content from {mmd_path}")
    sys.exit(1)

Technical Analysis

When a local Mermaid renderer is unavailable, the script advises users to copy the contents of the Mermaid input file to https://mermaid.live. The project is designed to produce diagrams from source code, so these files may reveal proprietary class names, function signatures, module relationships, architecture, internal package names, or sensitive values accidentally included in diagram labels.

The script does not automatically upload data, and no automatic exfiltration mechanism was identified. Disclosure occurs only if a user follows the recommendation. However, the message does not warn users that the destination is a third-party service or require them to review and sanitize the content before submission.

Attack Path

1. A user generates a Mermaid diagram from private or proprietary source code.
2. The local mmdc command is missing or fails.
3. The renderer displays the recommendation to paste the diagram into mermaid.live.
4. The user follows the recommendation without reviewing or sanitizing the file.
5. Source-derived architecture and identifiers are transmitted to an external service.
6. The information becomes subject to that service's processing, logging, retention, and access controls.

Impact Assessment

This issue does not grant local syst ...[truncated 394 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an offline renderer and make local rendering the documented default.
2. Add an explicit warning that Mermaid files generated from private source code may contain confidential information.
3. Instruct users to obtain authorization and sanitize the diagram before submitting it to any external service.
4. Clearly state that using mermaid.live transmits content to a third party and link to the applicable privacy and retention policies.
5. Avoid presenting external upload as a “quick alternative” without a confirmation or privacy notice.
6. Consider removing the external-service recommendation entirely in environments intended for proprietary code.
7. Add automated filtering or detection for common secret patterns before suggesting external rendering, while clarifying that such filtering cannot guarantee complete sanitization.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared purpose centers on transforming pasted source code into a visual representation of code structure. The supplied code does something narrower and different: it renders an already-authored Mermaid diagram file into an image format. While Mermaid rendering could be a supporting step in a larger visualization pipeline, this code chunk alone lacks the core advertised capability of interpreting source code and producing the diagram content. Therefore the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose is an end-user feature for transforming source code into visual representations. The actual code chunk is an internal test harness for skill packaging and documentation quality checks. Its primary behavior is repository validation and secret scanning, not code-to-mindmap functionality. This is materially different from the declared purpose and includes unrelated capabilities/triggers centered on project QA rather than user code visualization.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This line imposes a fixed language policy ('Keep SKILL.md body in English') in natural-language instructions. The rule set flags language or locale policy violations when a skill forces a specific language without user opt-in or a clearly justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This instruction explicitly requires content to be in English, which is a natural-language policy constraint applicable across all file types. No opt-in, alternative language support, or documented justification is provided here, so it matches the language-policy violation criterion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation condition '源代码 + 可视化/思维导图/流程图意图' is only loosely specified and does not define exact trigger phrases, scope limits, or exclusion cases. Because requests for visualization, mind maps, or flowcharts are common, this wording could cause unintended invocation when a user wants a generic diagram rather than this specific code-analysis skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation language includes broad phrases like 'draw the architecture' and 'visualize the structure,' which can match non-code or ambiguous requests and cause unintended skill activation. Over-broad routing is dangerous because it can divert user requests into code-processing workflows, increasing the chance of mishandling sensitive pasted content or producing irrelevant outputs in contexts where code analysis was not intended.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render.py (reported line 19)May include surrounding context.

python

# Try mmdc (Mermaid CLI) first — most reliable
    mmdc = os.getenv("MMDC_PATH", "mmdc")
    try:
        subprocess.run(
            [mmdc, "-i", mmd_path, "-o", output_path, "-b", format],
            check=True, capture_output=True
        )

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is described as turning pasted source code into a visual structure such as a mind map or diagram. This file executes a local external program (mmdc) through subprocess.run, which is a stronger capability than simple in-process transformation/rendering and is not stated in the manifest. Spawning external executables expands the skill's operational scope beyond what users would infer from the description.

Content

No source excerpt is available for this finding.

Tainted flow: 'mmdc' from os.getenv (line 17, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 82% confidence

Finding

The executable name is taken from the MMDC_PATH environment variable and passed directly to subprocess.run. In a hostile or multi-tenant execution environment, an attacker who can influence environment variables could cause the script to execute an arbitrary program instead of the expected Mermaid CLI.

Content

Scanner excerpt · scripts/render.py (reported line 19)May include surrounding context.

python

# Try mmdc (Mermaid CLI) first — most reliable
    mmdc = os.getenv("MMDC_PATH", "mmdc")
    try:
        subprocess.run(
            [mmdc, "-i", mmd_path, "-o", output_path, "-b", format],
            check=True, capture_output=True
        )

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code requires the presence of README_zh.md, which imposes a Chinese-language documentation requirement as part of the skill's test suite. That is a natural-language locale constraint, and the file does not indicate any user choice, opt-in, or region-specific justification for enforcing it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file prominently presents a Chinese-language README link, which is a natural-language locale choice embedded in the skill documentation. While not severe, this can be interpreted as a locale-specific documentation policy choice without explicit user opt-in or explanation of scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This README instructs users in Chinese throughout and does not explicitly offer a language or locale choice within the file itself. That can be a natural-language policy concern if users are forced into a specific language without opt-in, especially in shared or multilingual environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.