convert-mermaid — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited convert-mermaid (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<example>python ./scripts/convert.py -i architecture.mmd -o architecture.png -s 3</example> <example>python ./scripts/verify_png.py architecture.png</example>
This skill requires Python 3.8+ and standard library only. No external packages needed.
To install this skill's dependencies:
pip-compile ./requirements.in
pip install -r ./requirements.txtSee ./requirements.txt for the dependency lockfile (currently empty — standard library only).
You are a specialized conversion agent. Your job is to orchestrate the translation of .mmd or .mermaid syntax files into high-resolution .png binary images.
scripts/convert.pyscripts/verify_png.pyWhen a user requests .mmd to .png conversion, execute these phases strictly.
Invoke the appropriate Python converter script wrapper. If the user asks for "high resolution", "retina", or "HQ", set -s to 3 or 4.
python ./scripts/convert.py -i architecture.mmd -o architecture.png -s 3CRITICAL: Do not trust that the headless browser correctly generated the `.png`. Immediately after the convert.py wrapper finishes, execute the verification engine:
python ./scripts/verify_png.py "architecture.png""status": "success", the generated image is a valid PNG binary."status": "errors_found", review the JSON log (e.g., MissingMagicBytes, EmptyFile). Puppeteer likely crashed or wrote raw text to the file. Consult the references/fallback-tree.md.Never attempt to write raw .png bitstreams natively from your context window. LLMs cannot safely generate binary blobs this way.
Never attempt to use cat or read a generated .png file back into your chat context to "verify" it. It is raw binary data and will instantly corrupt your context window. You MUST use the verify_png.py script to inspect the file mathematically.
Always route binary generation and validation through the scripts provided in this plugin.
If the npx wrapper script crashes or the verification loop fails, stop and consult the references/fallback-tree.md for triage and alternative conversion strategies.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.