d2-diagram
Fail
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in
SKILL.mdsuggest installing the D2 diagramming tool using the commandcurl -fsSL https://d2lang.com/install.sh | sh. Piping a remote script directly into a shell is a high-risk execution pattern, even when targeting an official domain. - [COMMAND_EXECUTION]: The included utility
assets/d2-facts.mjsinvokes thed2binary viaexecFileSyncto perform diagram rendering, layout checking, and fact extraction. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted diagram data from
.d2files and their subsequent SVG/TXT renders. While this introduces an attack surface for indirect prompt injection (e.g., phantom boxes or misleading labels), the skill provides a robust mitigation strategy through thed2-facts.mjsutility, which explicitly checks for duplicates, truncated renders, and unauthorized edges to ensure the agent is not misled by silent rendering failures.
Recommendations
- HIGH: Downloads and executes remote code from: https://d2lang.com/install.sh - DO NOT USE without thorough review
Audit Metadata