d2-diagrams

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides installation commands that fetch the D2 binary from official sources including d2lang.com and oss.terrastruct.com. These are legitimate domains for the D2 project and its parent company, Terrastruct.
  • [REMOTE_CODE_EXECUTION]: The installation section contains a shell one-liner (curl -fsSL https://d2lang.com/install.sh | sh) which pipes a remote script into the shell. While this is a sensitive operation, it targets the official D2 installation script from a well-known service and is documented as a standard setup procedure for the tool.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute d2 commands for rendering diagrams (SVG, PNG, PDF) and managing themes/layouts. These operations are within the stated scope of a diagramming skill.
  • [SAFE]: The syntax examples include external SVG icons from icons.terrastruct.com and links to github.com. These references are to well-known, trusted domains and do not involve sensitive data exposure or exfiltration.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 08:37 PM
Security Audit — agent-trust-hub — d2-diagrams