The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically resolves a plugin directory path using the find command on the local filesystem and subsequently executes shell scripts (ensure-deps.sh, extract_d2.sh) from that computed path. If an attacker can place a malicious directory structure within the search scope, it could lead to the execution of arbitrary code.
[COMMAND_EXECUTION]: User-supplied arguments ($ARGUMENTS) are used to determine input files and directories for rendering. These values are interpolated into shell commands (e.g., d2 {input_file} ...), which poses a risk of command injection if the input is not strictly validated or if the agent handles special shell characters incorrectly.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute maintenance scripts (ensure-deps.sh) which may perform network operations or install software to satisfy dependencies. While typical for this type of utility, executing scripts with broad filesystem access carries inherent risks.
[REMOTE_CODE_EXECUTION]: The skill provides instructions to the user to run npm install -g playwright if specific rendering features fail. While Playwright is a well-known tool, recommending global software installation and subsequent execution of binary installers is a significant capability that requires user trust.

d2-render