mermaid-lint

Mermaid Lint（archived）

This skill is archived. The files stay in archive/mermaid-lint/ as historical reference and are not recommended for user-scope install. Ordinary Mermaid authoring does not load it.

The rest of this file is the archived workflow.

Author Mermaid safely, then validate every diagram with the real renderer. Locate and fix syntax, rendering, and unsafe-configuration defects.

This skill is user-invoked: run it only when the user explicitly calls /mermaid-lint (or $mermaid-lint); it is not selected automatically during diagram authoring.

Input: one or more markdown file paths, globs, or directories. If the user gives none, search the current directory for .md files and ask which ones to check.

Secure-by-default authoring

When creating or materially editing a diagram, use the repository's centralized Mermaid security configuration if it enforces an equivalent or stronger policy. Otherwise begin each block with:

%%{init: {"securityLevel": "strict", "htmlLabels": false}}%%
flowchart LR
    A["Plain-text label"] --> B["Plain-text label"]

Apply this baseline:

• Keep diagrams non-interactive. Put links beside the diagram in Markdown instead of using click actions.
• Use quoted plain-text labels. Treat text from users, tools, logs, and external documents as untrusted; normalize it before placing it in Mermaid source.
• Keep securityLevel at strict or sandbox and htmlLabels at false.
• Reject loose / antiscript, htmlLabels: true, callback actions, javascript: URLs, and an empty secure allowlist.
• If the repository owns a runtime renderer, configure the same baseline centrally, sanitize the rendered SVG before DOM insertion, and block renderer network access. The repository configuration remains the source of truth; do not add per-diagram directives that the target renderer rejects.

For an existing diagram, preserve intent and appearance while bringing any unsafe configuration to the baseline. If the target platform cannot support the baseline, report the incompatibility instead of weakening security silently.