Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/render-mermaid-handdraw.mjs --input /path/to/<name>.mmd --out-dir /path/to/output --name <name>
Security audit
handdraw-flowchart
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent local diagram-rendering skill, with ordinary npm/browser dependency risk but no evidence of hidden, destructive, or deceptive behavior.
Install only if you are comfortable running npm dependencies and a headless browser locally. Prefer locked installs and dependency auditing before using it on untrusted or very large Mermaid inputs, keep output directories scoped to your workspace, and tell the agent your preferred label language when needed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/render-mermaid-handdraw.mjs --input /path/to/<name>.mmd --out-dir /path/to/output --name <name>
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - For reproducible results, keep the versions pinned in `package.json` unless there is a specific reason to upgrade and retest the renderer.
Known Vulnerable Dependency: nanoid==4.0.2 — 4 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2024-55565 (Predictable results in nanoid generation when given non-integer values) +1 more
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The lockfile includes nanoid 4.0.2 as a transitive dependency. Reported nanoid issues include predictable output for malformed size inputs and denial-of-service conditions from invalid size/custom generator usage; in a diagram-generation skill that may process untrusted input, this is a real supply-chain risk if the package is invoked with attacker-influenced parameters, though it is not evidence of active exploitation by itself.
- Content
Known Vulnerable Dependency: immutable==4.3.8 — 2 advisory(ies): CVE-2026-59879 (Immutable.js `List` 32-bit trie overflow → unrecoverable DoS); CVE-2026-59880 (Immutable: Hash-collision algorithmic complexity denial of service in Immutable.)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
immutable 4.3.8 is a real vulnerable dependency per the cited advisories, mainly around denial-of-service through pathological inputs. In this skill context, where large or adversarial Mermaid content may be transformed through complex frontend libraries, exploitable impact is more likely to be process instability or resource exhaustion than code execution.
- Content
Known Vulnerable Dependency: lodash-es==4.17.21 — 3 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names); CVE-2025-13465 (Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions)
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
lodash-es 4.17.21 has known prototype-pollution and template/code-injection history, and prototype pollution is particularly relevant in tools that parse attacker-supplied structured text like Mermaid diagrams. Even when reachable only transitively, these bugs can become dangerous if vulnerable helper functions are exercised on untrusted object paths or templating data inside rendering or conversion code.
- Content
Known Vulnerable Dependency: nanoid==3.3.3 — 4 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2024-55565 (Predictable results in nanoid generation when given non-integer values) +1 more
High
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
nanoid 3.3.3 is also present as a separate vulnerable version, so the project contains multiple affected ID-generation paths. As with the 4.x finding, likely impact here is denial of service or weak ID generation under malformed inputs rather than direct compromise, but untrusted input handling in this skill makes it a legitimate issue to remediate.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill instructs the agent to run local commands (
npm install,node ...) and explicitly references environment-dependent behavior (CHROME_PATH), but it does not declare any tool scope or permission boundaries. That creates an execution-scope ambiguity where an agent may invoke shell/environment access more broadly than intended, increasing the risk of unintended command execution, dependency installation, or environment-variable exposure during use.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Known Vulnerable Dependency: dompurify==3.4.2 — 10 advisory(ies): CVE-2026-75838 (DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing X); CVE-2026-65902 (DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` perman); CVE-2026-66010 (DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowe) +7 more
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
dompurify 3.4.2 is present and DOMPurify flaws are especially relevant in a Mermaid/Excalidraw rendering pipeline because the skill handles diagram text that may contain labels, HTML-like content, or embedded markup derived from untrusted natural-language input. If the library is used in browser rendering paths, bypasses in sanitization can enable XSS or script execution in the rendering context.
- Content
Known Vulnerable Dependency: esbuild==0.28.0 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)
Low
- Category
- Supply Chain
- Confidence
- 76% confidence
- Finding
esbuild 0.28.0 has a known arbitrary file-read issue tied to its development server on Windows. This is a real vulnerability in the package version, but within this skill it appears less dangerous unless the skill runs esbuild's dev server in a Windows environment, which is not implied by the lockfile alone.
- Content
Known Vulnerable Dependency: mermaid==11.14.0 — 9 advisory(ies): CVE-2026-71436 (Mermaid XY Charts are vulnerable to an infinite loop DoS); CVE-2026-71437 (Mermaid Architecture diagrams are vulnerable to prototype pollution); CVE-2026-41150 (Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS) +6 more
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
mermaid 11.14.0 is central to this skill and the cited Mermaid advisories are highly relevant because the skill explicitly generates, validates, and renders Mermaid from natural-language descriptions that may be attacker-controlled. Parser-level infinite loops, prototype pollution, or rendering-time issues directly affect this workflow and can lead to denial of service or compromise of the rendering context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L11 instructs authors to 'put Chinese text inside labels,' which imposes a specific language convention. Because the document does not offer user opt-in or explain a region-specific requirement, this is a natural-language locale policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The example at L31 uses Chinese labels as the default pattern, reinforcing a single-language output convention. In the absence of a documented locale justification or an explicit user choice, this can violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Lines L53-L57 present participant aliases and messages in Chinese as the normative example. This creates an implicit requirement for a specific language without user opt-in or stated regional justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Line L90 tells authors to put Chinese meaning in comments outside the diagram if needed, again assuming Chinese as the expected descriptive language. Without an explicit locale rationale or user choice, this is a policy concern.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest describes Mermaid validation, Mermaid-to-Excalidraw conversion, and PNG export. While launching a browser is expected for rendering, consulting an environment variable for executable discovery introduces ambient-environment access that is not stated as part of the skill's purpose.
- Content