Trust Assessment
beautiful-mermaid received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 1 critical, 2 high, 0 medium, and 0 low severity. Key findings include HTML Injection / XSS in generated HTML via SVG content, Dynamic package installation using `execSync`, Supply Chain Risk: Unpinned dependency `beautiful-mermaid`.
The analysis covered 4 layers: manifest_analysis, llm_behavioral_safety, dependency_graph, static_code_analysis. The llm_behavioral_safety layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 326f2466). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | HTML Injection / XSS in generated HTML via SVG content The `scripts/create-html.ts` script reads an SVG file and directly embeds its content into an HTML wrapper. If the SVG content (which can be derived from user-provided Mermaid code) contains malicious HTML or JavaScript (e.g., `<script>alert(document.domain)</script>`, `<img src=x onerror=alert(1)>`), this code will be executed when `agent-browser` opens the generated HTML file. Since `agent-browser` opens a `file://` URL, the injected script will have broad access to the local filesystem, enabling data exfiltration, local file manipulation, or further attacks. The SVG content must be thoroughly sanitized before being embedded into the HTML. This typically involves parsing the SVG and removing all script tags, event handlers, and potentially dangerous attributes, or using a library that specifically sanitizes SVG for embedding in HTML. Alternatively, render the SVG in a sandboxed iframe or use a headless browser's built-in SVG rendering capabilities without embedding it directly into a user-controlled HTML document. | Unknown | scripts/create-html.ts:142 | |
| HIGH | Dynamic package installation using `execSync` The `scripts/render.ts` script uses `node:child_process.execSync` to install the `beautiful-mermaid` package if it's not found. While the package name is hardcoded, using `execSync` for package management is a dangerous practice. If the package name were ever derived from user input, it would lead to a critical command injection vulnerability. Even with a hardcoded name, it relies on external system commands (`bun add`, `npm install`) which can be manipulated in certain environments or if the package manager itself is compromised. Declare all dependencies in a `package.json` file and rely on the agent's environment to install them securely. Avoid dynamic package installation using shell commands within skill scripts. If dynamic installation is absolutely necessary, use safer alternatives that do not involve `execSync` or ensure strict sanitization and whitelisting of package names. | Unknown | scripts/render.ts:136 | |
| HIGH | Supply Chain Risk: Unpinned dependency `beautiful-mermaid` The `scripts/render.ts` script dynamically installs the `beautiful-mermaid` package without specifying a version. This means that any new version of `beautiful-mermaid` will be installed, including potentially malicious updates. This introduces a significant supply chain risk, as a compromised `beautiful-mermaid` package could execute arbitrary code within the agent's environment. Pin the `beautiful-mermaid` dependency to a specific, known-good version in a `package.json` file. Regularly review and update dependencies to newer versions after security vetting. | Unknown | scripts/render.ts:120 |
Scan History
Embed Code
[](https://skillshield.io/report/a758e75812c8061b)
Powered by SkillShield