ClawHub
Back to skill

Security audit

AHA Mermaid Diagram

Security checks for vulnerabilities and agentic risk

Overview

This is a Mermaid diagram guidance skill with normal documentation examples, but its HTML rendering snippets need care around third-party scripts and untrusted diagrams.

Install is reasonable for Mermaid diagram help. Be careful before copying the HTML snippets into production or sensitive environments: prefer a pinned or self-hosted Mermaid dependency, avoid securityLevel: 'loose' for untrusted diagrams, keep Mermaid input size limits conservative, and review any interactive links in generated diagrams.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:265
Finding

Unsafe Mermaid Rendering Configuration Permits Active Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:265-271
Vulnerability Type: Unsafe client-side rendering configuration
Risk Level: Medium

javascript
mermaid.initialize({
  startOnLoad: false,
  maxTextSize: 99999,
  fontSize: 14,
  securityLevel: 'loose'
});

Technical Analysis

The documented Mermaid configuration explicitly sets securityLevel to loose. This mode relaxes Mermaid's restrictions on HTML labels, links, and interactive content. If diagram definitions originate from users, repositories, generated model output, or other untrusted sources, a crafted definition may introduce active or deceptive content into the page hosting the rendered diagram.

The configuration also raises maxTextSize to 99999, substantially increasing the amount of diagram text Mermaid will process. This weakens a resource-consumption safeguard and may amplify client-side denial-of-service risk from unusually large or complex diagrams.

Exploitation requires an application or user to adopt this example and render attacker-controlled Mermaid content without separate validation or sanitization. This is an insecure documented configuration rather than evidence of an existing deployed application compromise.

Attack Path

  1. A developer adopts the HTML rendering configuration from SKILL.md.
  2. The resulting page accepts or renders Mermaid definitions from an untrusted source.
  3. An attacker supplies a crafted diagram containing unsafe HTML or interactive link content, or a very large and complex diagram.
  4. Mermaid renders the input under securityLevel: 'loose'.
  5. Depending on the Mermaid version and browser integration, the crafted content may create active page content, deceptive navigation, or DOM interactions in the hosting page.
  6. Alternatively, oversized diagram input may consume excessive browser CPU or memory and impair page availability.

Impact Assessment

Successful exploitation ...[truncated 674 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace securityLevel: 'loose' with securityLevel: 'strict' for ordinary rendering of untrusted or generated diagrams.
  2. If stronger isolation is required, use Mermaid's sandboxed rendering mode or render diagrams inside a properly sandboxed iframe with the minimum necessary capabilities.
  3. Restore a conservative maxTextSize limit based on expected diagram sizes and reject oversized input before rendering.
  4. Validate Mermaid input against an allowed subset of diagram syntax before processing it.
  5. Disable clickable links when they are unnecessary. Where links are required, permit only approved https origins and reject dangerous or unexpected URI schemes.
  6. Apply a restrictive Content Security Policy that limits script sources, navigation targets, framing, and inline execution.
  7. Pin Mermaid to a reviewed, supported version and apply security updates promptly.
  8. Document that loose mode must never be used with user-controlled, repository-controlled, or otherwise untrusted diagram content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list includes broad everyday terms such as 'diagram', 'flow', 'model', and 'architecture', which can cause the skill to activate in contexts far beyond the user's intent. Over-broad invocation increases the chance that unrelated conversations are routed into this skill, potentially exposing user content to unnecessary processing or causing unsafe downstream behaviors in environments with automatic skill selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The troubleshooting guidance says "Use English identifiers" in response to Chinese class names, which imposes a language restriction in natural-language guidance. The file does not present this as an optional workaround, nor does it explain a justified region-specific constraint or offer a user choice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/flowcharts.md (reported line 370)May include surrounding context.

md
Start([Select deployment strategy]) --> Env{Environment?}
    
    Env -->|Development| DevDecision{Automated tests?}
    DevDecision -->|Pass| DevDeploy[Auto-deploy to dev]
    DevDecision -->|Fail| Block[Block deployment]
    
    Env -->|Staging| StageDecision{All checks pass?}

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation claims expertise in 'all diagram types' including Gantt Charts at L006-L008, and later explicitly lists Gantt Charts as a supported use case at L065. However, the 'NEVER Do' section states 'NEVER use Mermaid for data visualization — it's for architecture, not charts' at L417, which conflicts with promoting Gantt-based timeline/chart output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation instructs users to import Mermaid from a third-party CDN without warning that this causes external network access and executes remotely hosted code in the browser. In privacy-sensitive or locked-down environments, this can leak metadata, violate policy, or create supply-chain exposure if the CDN resource is compromised or unexpectedly changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The HTML template embeds a third-party Mermaid import from jsDelivr but does not disclose the network dependency or associated supply-chain/privacy considerations. Users may copy this template into sensitive contexts unaware that page loads will contact an external service and execute remotely served code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.