d2-diagrams
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides installation commands that fetch the D2 binary from official sources including
d2lang.comandoss.terrastruct.com. These are legitimate domains for the D2 project and its parent company, Terrastruct. - [REMOTE_CODE_EXECUTION]: The installation section contains a shell one-liner (
curl -fsSL https://d2lang.com/install.sh | sh) which pipes a remote script into the shell. While this is a sensitive operation, it targets the official D2 installation script from a well-known service and is documented as a standard setup procedure for the tool. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to executed2commands for rendering diagrams (SVG, PNG, PDF) and managing themes/layouts. These operations are within the stated scope of a diagramming skill. - [SAFE]: The syntax examples include external SVG icons from
icons.terrastruct.comand links togithub.com. These references are to well-known, trusted domains and do not involve sensitive data exposure or exfiltration.
Audit Metadata