mermaid — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mermaid (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Canonical source:examples/MERMAID_ACCESSIBILITY_BEST_PRACTICES.mdinmgifford/ACCESSIBILITY.mdThis skill is derived from that file. When in doubt, the example is authoritative.
Apply these rules when authoring, generating, or reviewing Mermaid diagrams. Only load this skill if the project uses Mermaid diagrams.
Every Mermaid diagram must include accessibility metadata and produce SVG output conforming to Pattern 11 — the most reliable pattern across screen reader/browser combinations, per Carie Fisher's testing at <https://cariefisher.com/a11y-svg-updated/>.
| Level | Meaning |
|---|---|
| Critical | Diagram conveys essential information with no accessible title or alternative |
| Serious | Title present but no description on a complex diagram; contrast fails |
| Moderate | SVG output does not implement Pattern 11; named edges lack context |
| Minor | Title over 100 chars; duplicate IDs; missing version check |
Missing `%%accTitle` on any meaningful diagram is Critical.
%%accTitle Brief title (max 100 characters)
%%accDescr Detailed description of what the diagram shows and whyTitle requirements:
Description requirements:
graph TD
A[User Login] --> B{Valid Credentials?}
B -->|Yes| C[Grant Access]
B -->|No| D[Show Error]
C --> E[Load Dashboard]
D --> F[Retry Login]
%%accTitle User Authentication Flowchart
%%accDescr Login process: credentials validated against database.
If valid, access granted and dashboard loads.
If invalid, error shown and user can retry login.%%accTitle and %%accDescr were introduced in Mermaid v9.4. Verify the Mermaid version in use before relying on these directives. Earlier versions silently ignore them — use a manual SVG wrapper or a text alternative instead.
Check version: import mermaid from 'mermaid'; console.log(mermaid.version);
Mermaid does not always produce Pattern 11-compliant SVG automatically, even when directives are set. The aria-labelledby referencing both title and description IDs may require post-processing or verification.
Expected Pattern 11 output:
<svg role="img"
aria-labelledby="chart-title chart-desc"
xmlns="http://www.w3.org/2000/svg">
<title id="chart-title">User Authentication Flowchart</title>
<desc id="chart-desc">Login process: credentials validated…</desc>
<!-- diagram content -->
</svg>Required attributes:
role="img" on root <svg>xmlns="http://www.w3.org/2000/svg"aria-labelledby referencing both title and desc IDsInspect the rendered SVG in browser DevTools after render. If aria-labelledby is missing or references only one ID, post-process the SVG or add a text alternative.
GitHub renders Mermaid in fenced code blocks ( `mermaid ) but the SVG output and accessibility attributes may not survive GitHub's sanitisation pipeline. Do not rely on Mermaid accessibility metadata for diagrams rendered in GitHub Markdown — provide an explicit text alternative below the code block:
graph TD …
**Diagram description:** Login flowchart. Valid credentials grant access and
load the dashboard. Invalid credentials show an error and allow retry.Following Léonie Watson's accessible SVG flowchart pattern (<https://tink.uk/accessible-svg-flowcharts/>):
<svg role="img" aria-labelledby="flow-title flow-desc">
<title id="flow-title">…</title>
<desc id="flow-desc">…</desc>
<g role="list">
<g role="listitem">
<title>Node label</title>
<!-- node shapes -->
</g>
</g>
</svg><title>aria-hidden="true" or role="presentation"aria-hidden="true" by defaultTest diagram colours in both light and dark modes:
Mermaid's default themes may not meet contrast in dark mode — verify and override theme variables as needed.
Before exporting or committing any diagram, verify:
%%accTitle and %%accDescr presentrole="img" on root SVG in rendered outputaria-labelledby references both title and desc IDs in rendered outputMermaidJS supports 23 diagram types across 5 categories. All types support accTitle / accDescr (Mermaid ≥ 9.4) and YAML frontmatter configuration.
Categories and types:
| Category | Types |
|---|---|
| Logic & Process | Flowchart, State Diagram, Mind Map |
| Interaction & Time | Sequence, User Journey, Gantt, Timeline |
| Data Structure | Class, Entity Relationship, C4, Architecture |
| Data Visualization | Pie, Quadrant, Radar, XY Chart, Sankey, Treemap |
| Domain-Specific | Git Graph, Requirement, Packet, Kanban, ZenUML, Block |
For a machine-readable reference of all 23 types, parsing approaches, and narrative generation support, see examples/MERMAID_DIAGRAM_TYPES.md.
When Mermaid's output does not produce Pattern 11 automatically, use this transformation pipeline:
// 1. Parse generated SVG
const doc = (new DOMParser()).parseFromString(svgString, 'image/svg+xml');
const svg = doc.documentElement;
// 2. Extract %%accTitle / %%accDescr from source
const title = mermaidSource.match(/%%\s*accTitle\s*(.+)/)?.[1] ?? '';
const desc = mermaidSource.match(/%%\s*accDescr\s*(.+)/)?.[1] ?? '';
// 3. Generate unique IDs (required when multiple diagrams exist on a page)
// Use crypto.randomUUID() for guaranteed uniqueness
const titleId = `title-${crypto.randomUUID()}`;
const descId = `desc-${crypto.randomUUID()}`;
// 4. Apply root attributes
svg.setAttribute('role', 'img');
svg.setAttribute('xmlns', 'http://www.w3.org/2000/svg');
svg.setAttribute('aria-labelledby', `${titleId} ${descId}`);
// 5. Remove any existing <title>/<desc> then insert new ones as first children
// (removal first ensures idempotent re-processing of already-transformed SVGs)
svg.querySelector('title')?.remove();
svg.querySelector('desc')?.remove();
const titleEl = document.createElementNS('http://www.w3.org/2000/svg', 'title');
titleEl.id = titleId; titleEl.textContent = title;
const descEl = document.createElementNS('http://www.w3.org/2000/svg', 'desc');
descEl.id = descId; descEl.textContent = desc;
svg.insertBefore(descEl, svg.firstChild);
svg.insertBefore(titleEl, svg.firstChild);Never remove during post-processing: <title>, <desc>, viewBox, xmlns, IDs used in references, role, or aria-* attributes.
Safe to remove: comments, extra whitespace, unused CSS classes.
/* Inside a <style> element in the SVG */
:root { --text: #1a1a1a; --bg: #ffffff; --border: #cccccc; }
@media (prefers-color-scheme: dark) {
:root { --text: #ffffff; --bg: #1a1a1a; --border: #333333; }
}
text { fill: var(--text); }
rect { fill: var(--bg); stroke: var(--border); }Alternatively, use color: currentColor so SVG inherits the page's color scheme.
%%accTitle present, ≤100 chars, unique, meaningful%%accDescr present, explains purpose and key relationshipsrole="img", <title>, <desc>, aria-labelledby both IDsStandards horizon: These rules target WCAG 2.2 AA. Monitor: <https://www.w3.org/TR/wcag-3.0/>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.