generate mermaid diagrams

Generate consistent, template-based Mermaid diagrams for technical content. Supports 12 diagram types (architecture, flowchart, sequence, concept-map, radial...

This skill appears to be what it claims (Mermaid diagram generation), but there are a few practical issues to check before installing: - Template filename mismatch: generate.mjs expects templates named <template>.mmd but the included assets are <template>.mmd.txt. Either rename the asset files to *.mmd or update the script to read .mmd.txt; otherwise generation will fail. - Dependency installation: The recommended install script performs a global npm install of @mermaid-js/mermaid-cli and requires Node >= 18. Global npm installs can require elevated permissions and modify your global environment — run the script in a controlled environment or adjust to a local install (npm install --prefix . @mermaid-js/mermaid-cli) if you prefer. - Local file access: The subagent pattern and scripts read project files (chapter markdown) and write .mmd/.svg/.png files to output directories. This is expected, but confirm you are comfortable with the skill reading the directories you point it at. - Test in isolation: Run the provided test commands (npm run test:semantic and test:render) in a sandbox or throwaway project to confirm behavior. Inspect and/or run scripts with --dry-run or limited inputs first. If you fix the filename mismatch and are okay with a global or local mermaid-cli install, the skill is coherent and usable. If you cannot verify these changes, treat it as untrusted or run it in an isolated environment.

Type: OpenClaw Skill Name: skill-mermaid-diagrams Version: 1.0.0 The skill contains a critical shell injection vulnerability (RCE) in `scripts/generate.mjs` and `scripts/validate.mjs`. The `template` name, read directly from the user-controlled `content.json` file, is embedded into `execSync` commands without proper sanitization or quoting. An attacker can craft a `content.json` with a malicious `template` name (e.g., `'; rm -rf /; #'`) to execute arbitrary commands on the host system. This is a severe vulnerability, but there is no evidence of intentional malicious design, classifying it as 'suspicious' rather than 'malicious'.