Trust Assessment
beautiful-mermaid received a trust score of 48/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 0 critical, 3 high, 1 medium, and 0 low severity. Key findings include Command Injection via user-controlled Mermaid code, Excessive Deno permissions: --allow-net, Excessive Deno permissions: --allow-read and --allow-write with user-controlled paths.
The analysis covered 4 layers: manifest_analysis, llm_behavioral_safety, static_code_analysis, dependency_graph. The static_code_analysis layer scored lowest at 48/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 326f2466). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Command Injection via user-controlled Mermaid code The skill demonstrates running `scripts/render.ts` with a `--code` argument that directly accepts user-provided Mermaid syntax. If the `render.ts` script passes this `--code` argument directly into a shell command or an `eval`-like function without proper escaping or sanitization, a malicious user could inject arbitrary shell commands. For example, `graph TD; A-->B"; rm -rf /` could lead to critical system compromise. The `render.ts` script must rigorously sanitize or escape the `--code` argument before using it in any shell command or dynamic execution context. Prefer using libraries that handle command arguments safely or pass data via stdin/files instead of directly embedding in shell commands. | Unknown | SKILL.md:50 | |
| HIGH | Excessive Deno permissions: --allow-net The `deno run` command explicitly requests `--allow-net` permission for the `scripts/render.ts` script. A diagram rendering script typically should not require network access. This permission, especially when combined with user-controlled input (Mermaid code), could be exploited for data exfiltration (e.g., sending local file contents if combined with `--allow-read` and a vulnerability in file handling) or Server-Side Request Forgery (SSRF) attacks, allowing the agent to probe internal networks or make arbitrary external requests. Remove the `--allow-net` permission unless it is absolutely critical for the rendering process. If network access is necessary, strictly validate and sanitize all network requests, ensuring they are only to trusted domains and do not expose local data or allow arbitrary external connections. | Unknown | SKILL.md:60 | |
| HIGH | Excessive Deno permissions: --allow-read and --allow-write with user-controlled paths The `deno run` command requests `--allow-read` and `--allow-write` permissions. The skill's workflow involves taking `--input` (e.g., `diagram.mmd`) and `--output` (e.g., `diagram`) arguments. If a malicious user can control these paths (e.g., by providing `../../../../etc/passwd` as input or output), the `--allow-read` permission could lead to arbitrary file exfiltration, and `--allow-write` could lead to arbitrary file creation or overwriting, potentially causing denial of service or further system compromise. Ensure `scripts/render.ts` strictly validates and sanitizes all input and output paths, restricting them to a designated, sandboxed directory. Avoid allowing arbitrary file system access. Implement robust path traversal prevention measures. | Unknown | SKILL.md:60 | |
| MEDIUM | Potential XSS/Code Execution via agent-browser and SVG/HTML The workflow involves generating an SVG from user-provided Mermaid code, wrapping it in an HTML file (`diagram.html`), and then opening this local HTML file using `agent-browser`. If the Mermaid code can embed malicious JavaScript or other active content within the SVG (e.g., `<script>` tags, `on*` attributes, `javascript:` URLs), and `agent-browser` executes this HTML/SVG in a non-sandboxed environment, it could lead to Cross-Site Scripting (XSS)-like attacks or arbitrary code execution within the `agent-browser`'s context. This could potentially allow data exfiltration or further compromise if `agent-browser` has elevated permissions. Ensure the SVG rendering process strictly sanitizes user-provided Mermaid code to prevent embedding of active content. The `agent-browser` skill should also run in a highly sandboxed environment, isolating it from the host system and network, and preventing execution of untrusted JavaScript from local `file://` URLs. | Unknown | SKILL.md:70 |
Scan History
Embed Code
[](https://skillshield.io/report/a81b0b3d7fadfe04)
Powered by SkillShield