Security audit

D2 Diagram Creator

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its diagram-generation purpose, but it includes mandatory removal of Tala's unlicensed watermark and unsafe remote installer instructions that users should review carefully before installing.

Install only if you are comfortable reviewing and changing the setup and validator behavior first. Prefer official package-manager or verified release installation for D2/Tala instead of curl-to-shell, and remove or disable the Tala watermark-removal script/instruction so generated outputs preserve licensing and provenance notices.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:18
Finding: Unverified Remote Installer Is Piped Directly into a Shell
Content: View full analysis
Vulnerability Details

File Location: README.md:18-21; duplicated in README_zh.md:20-23
Vulnerability Type: Remote code retrieval and immediate execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://d2lang.com/install.sh | sh -s -- # TALA is a powerful diagram layout engine specifically designed for software architecture diagrams. It requires separate installation. curl -fsSL https://d2lang.com/install.sh | sh -s -- --tala

The Chinese README contains equivalent commands:

bash
curl -fsSL https://d2lang.com/install.sh | sh -s -- # TALA is a powerful diagram layout engine specifically designed for software architecture diagrams. It requires separate installation. curl -fsSL https://d2lang.com/install.sh | sh -s -- --tala

Technical Analysis

These instructions download a mutable remote response and immediately pass it to sh. Users are not given an opportunity to inspect the installer, and no version pin, cryptographic checksum, or publisher-signature verification is performed.

The D2 command-line tool is needed for validation and image export, but executing an unverified remote script is not necessary for the Skill's core diagram-generation functionality and does not follow least-privilege supply-chain practices. Repository review cannot establish what code these commands will execute in the future.

HTTPS protects transport under normal conditions but does not protect against compromise of the hosting origin, an improperly issued certificate, malicious changes by an upstream maintainer, or a compromised delivery pipeline.

Attack Path

A user follows the dependency-installation instructions.

The curl process retrieves the current content of https://d2lang.com/install.sh.

The remote origin, delivery infrastructure, or installer content has been compromised or maliciously modified.

Because the response is piped directly into sh, the mod ...[truncated 817 chars]
Remediation: View remediation
Remediation Suggestions

Replace curl | sh instructions with an official package-manager installation method using a pinned package version.

If direct downloads are unavoidable, download a versioned release artifact to disk rather than executing a mutable URL:

Pin an explicit release version.

Obtain the expected checksum through a separately authenticated channel.

Verify a cryptographic signature or SHA-256 checksum.

Inspect the downloaded installer before executing it.

Document the exact files, directories, and permissions used by the installer.

Keep Tala installation clearly optional and recommend Dagre or ELK when Tala-specific functionality is unnecessary.

Apply the same corrections to both README.md and README_zh.md.

other

Error

Location: agents/validator.md:69
Finding: Mandatory Removal of Tala's “UNLICENSED COPY” Watermark
Content: View full analysis
Vulnerability Details

File Location: agents/validator.md:69-73; implementation in scripts/remove_watermark.py:17-24
Vulnerability Type: License-notice and output-integrity circumvention
Risk Level: High

Vulnerable Instruction:

markdown
#### Tala engine special handling - Tala only supports SVG. If the user wanted PNG, fall back to dagre/elk and note this in your output. - Check installation: `d2 layout tala` - If not installed, tell the user: "Tala engine is not installed. See https://github.com/terrastruct/tala" - **After SVG export with tala, you MUST remove the watermark.** The script is at `<skill-base-path>/scripts/remove_watermark.py`. Run: `python <skill-base-path>/scripts/remove_watermark.py output.svg`. This step is not optional — tala always adds a watermark and the user does not want it.

Supporting Implementation:

python
content = svg_path.read_text(encoding='utf-8') new_content = content.replace('UNLICENSED COPY', '') if content == new_content: print("'UNLICENSED COPY' text not found") return svg_path.write_text(new_content, encoding='utf-8') print(f"Watermark removed: {svg_path}")

Technical Analysis

The validator explicitly requires the agent to remove the text UNLICENSED COPY from every SVG exported with Tala. The instruction is mandatory and is implemented by modifying the generated file in place.

Removing an unlicensed-product notice is unrelated to validating D2 syntax or producing a technically correct diagram. It exceeds the minimum behavior required for the declared diagram-generation functionality and conceals license-status information intentionally placed in Tala output.

This behavior also compromises output provenance and integrity: the file returned to the user no longer accurately reflects the output produced by the selected renderer.

Attack Path

A user selects Tala as the SVG layout engine.

T ...[truncated 918 chars]
Remediation: View remediation
Remediation Suggestions

Remove the mandatory watermark-removal instruction from agents/validator.md.

Remove scripts/remove_watermark.py from the Skill.

Preserve all notices generated by Tala unless the user has a valid license and the vendor provides an authorized mechanism for producing unwatermarked output.

When no suitable Tala license is available, automatically use Dagre or ELK and clearly disclose the fallback.

Record the selected renderer in the validator summary so recipients can establish output provenance.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/remove_watermark.py:8
Finding: Unrestricted In-Place File Rewrite Through User-Supplied Path
Content: View full analysis
Vulnerability Details

File Location: scripts/remove_watermark.py:8-25
Vulnerability Type: Unconfined file modification and symlink-following weakness
Risk Level: Medium

Vulnerable Code:

python
if len(sys.argv) < 2: print("Usage: python remove_watermark.py <svg_file_path>") sys.exit(1) svg_path = Path(sys.argv[1]) if not svg_path.exists(): print(f"Error: File not found - {svg_path}") sys.exit(1) content = svg_path.read_text(encoding='utf-8') new_content = content.replace('UNLICENSED COPY', '') if content == new_content: print("'UNLICENSED COPY' text not found") return svg_path.write_text(new_content, encoding='utf-8') print(f"Watermark removed: {svg_path}")

Technical Analysis

The script trusts an arbitrary command-line path and overwrites the referenced object in place. It does not verify that the path:

Is within an approved diagram-output directory.

Has an .svg extension.

Is a regular file rather than a symbolic link or another filesystem object.

Contains valid SVG content.

Still refers to the same file between validation, reading, and writing.

Path.exists() follows symbolic links. Consequently, a path controlled by another process can reference or be swapped to a different file before the write. The script then rewrites that target if its UTF-8 content includes UNLICENSED COPY.

The current orchestration normally passes a generated output path, so exploitation requires influence over that path or the filesystem entry. Nevertheless, the script provides no internal confinement and is unsafe when invoked by an agent with broader filesystem access.

Attack Path

An attacker or untrusted workflow gains influence over the path passed to remove_watermark.py, or can manipulate the corresponding filesystem entry.

The attacker supplies a path or symbolic link to another UTF-8 file writable by the agent.

...[truncated 891 chars]
Remediation: View remediation
Remediation Suggestions

Prefer removing this script entirely because its stated purpose is watermark circumvention.

For any legitimate SVG transformation utility:

Resolve the input with Path.resolve(strict=True).

Require the resolved path to be inside a dedicated output directory.

Reject symbolic links and non-regular files.

Validate the expected .svg extension and parse the file as SVG/XML.

Apply an explicit maximum file-size limit.

Do not overwrite the source file. Write to a new file in the approved output directory.

Use atomic file creation and replacement where replacement is genuinely required.

Minimize race conditions by opening files with platform-appropriate no-follow and exclusive flags rather than performing a separate existence check.

Run the validator with filesystem permissions restricted to its designated workspace.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (22)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This command directly downloads and executes a remote script in the user's shell, granting the script full execution privileges on the local machine. In a skill README, such instructions are especially dangerous because users may copy-paste them during setup with elevated trust and without reviewing the fetched code.
Content: Scanner excerpt · README.md (reported line 18)May include surrounding context.
The recommended and simplest installation method is to use D2's installation script, which will detect your operating system and architecture and use the best installation method.

bash
curl -fsSL https://d2lang.com/install.sh | sh -s -- # TALA is a powerful diagram layout engine specifically designed for software architecture diagrams. It requires separate installation. curl -fsSL https://d2lang.com/install.sh | sh -s -- --tala

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This second pipe-to-shell command repeats the same unsafe pattern for installing an additional component, expanding the attack surface and reinforcing risky operator behavior. If the remote installer or delivery path is tampered with, it can execute arbitrary commands and persist malware on the host.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
curl -fsSL https://d2lang.com/install.sh | sh -s --

TALA is a powerful diagram layout engine specifically designed for software architecture diagrams. It requires separate installation.

curl -fsSL https://d2lang.com/install.sh | sh -s -- --tala

text
Please refer to the official D2 documentation for details:

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This command fetches an external install script and executes it immediately in the shell, creating a direct remote code execution path on the user's system. If the hosting domain, script contents, TLS trust chain, or upstream project is compromised, the attacker gains code execution with the user's privileges.
Content: Scanner excerpt · README_zh.md (reported line 20)May include surrounding context.
推荐且最简单的安装方法是使用 D2 的安装脚本，该脚本将检测您使用的操作系统和架构，并使用最佳安装方法

bash
curl -fsSL https://d2lang.com/install.sh | sh -s -- # TALA 是一款专为软件架构图设计的图表布局引擎，非常强大，该引擎需要单独安装 curl -fsSL https://d2lang.com/install.sh | sh -s -- --tala

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The TALA installation command repeats the same unsafe pattern of executing remote script content directly from the network. This increases exposure because users may run multiple unverified scripts, multiplying the chance of compromise and normalizing insecure installation behavior.
Content: Scanner excerpt · README_zh.md (reported line 23)May include surrounding context.
curl -fsSL https://d2lang.com/install.sh | sh -s --

TALA 是一款专为软件架构图设计的图表布局引擎，非常强大，该引擎需要单独安装

curl -fsSL https://d2lang.com/install.sh | sh -s -- --tala

text
具体请参考 D2 的官方文档：

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The advertised purpose is diagram generation, but the validator stage references a watermark-removal script and performs edits on exported SVG files. That is unrelated to normal D2 synthesis and can conceal unauthorized content modification, especially because it reads and rewrites files as part of the workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The validator is instructed to execute shell commands and a Python script derived from runtime inputs such as file paths, export options, and skill base path. For a diagram-generation skill, this expands privileges from content generation into command execution and local script running, creating command-injection, unsafe file access, and unauthorized code execution risk if inputs are attacker-controlled or insufficiently constrained.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Mandating removal of Tala's watermark without user opt-in is an instruction to bypass or alter a third-party product's attribution/output controls. That is risky both from a policy/compliance standpoint and because it normalizes unauthorized post-processing behavior unrelated to the core skill purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code modifies existing SVG files to strip watermark text instead of generating D2 diagram code as declared in the skill metadata. This mismatch between advertised purpose and actual behavior is a strong indicator of deceptive or unauthorized functionality, and in context it increases the likelihood that the skill is intended to facilitate misuse rather than provide diagram creation features.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script is explicitly designed to remove the text 'UNLICENSED COPY' from SVG files, which strongly suggests watermark removal from unlicensed output. That is unrelated to the stated D2 diagram-generation purpose and indicates functionality aimed at bypassing licensing or attribution controls, making the skill materially more suspicious in context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README recommends executing a remotely fetched shell script via a pipe to sh without any integrity verification, pinning, or warning. This exposes users to arbitrary code execution if the remote host, transport, or script content is compromised, and normalizes an unsafe installation pattern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README instructs users to execute a remote script by piping curl output directly into sh, which allows arbitrary code from the remote server or any compromised delivery path to run immediately on the user's machine. Because no integrity verification, pinning, or warning is provided, users are encouraged to bypass normal review steps and trust network-fetched code blindly.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs subagents to read and write files, but the manifest does not declare any explicit tool scope or allowed-tools boundary. That creates ambiguity about what filesystem capabilities the skill may exercise and increases the chance of unintended file access or writes during execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description is very broad and can trigger on many ordinary requests involving diagrams, layouts, relationships, or visual structure. Overbroad matching can cause unnecessary skill invocation and expose users to file-writing or export behaviors in contexts where they did not clearly request them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill directs agents to save generated D2 files and exported outputs without any user-facing warning or consent flow for file creation. Silent writes can surprise users, clutter workspaces, or overwrite expected artifacts, especially in an automated multi-agent pipeline.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Including a watermark-removal capability in a diagram-generation skill is a strong red flag because it enables removal of attribution or licensing marks from generated or third-party assets. This functionality is unrelated to the stated task and normalizes file tampering under the cover of export validation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Line L71 states that entity IDs must be 'in English', imposing a specific language constraint in the skill instructions. This is a natural-language policy concern because the skill does not offer the user a language choice or explain a justified locale-specific requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill tells the validator to fix issues directly in the input .d2 file, but it does not require user consent, backup creation, or writing to a separate output path. Silent in-place modification can overwrite user data, destroy provenance, and let an agent alter files beyond what the user expects from a validation step.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions explicitly require post-processing exported SVGs to remove Tala watermarks, which goes beyond normal diagram generation and into altering third-party tool output. This adds unnecessary script-execution capability and creates legal/compliance and integrity risks while broadening the attack surface for file manipulation.
Content: No source excerpt is available for this finding.

Tainted flow: 'new_content' from pathlib.Path.read_text (line 18, file read) → pathlib.Path.write_text (file write)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/remove_watermark.py (reported line 24)May include surrounding context.
python
print("'UNLICENSED COPY' text not found") return svg_path.write_text(new_content, encoding='utf-8') print(f"Watermark removed: {svg_path}")

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The README claims the skill will automatically generate image files but does not disclose where files are written or that running the skill may modify the local filesystem. In an agent-skill context, undisclosed file creation is a meaningful security and safety concern because users may invoke the skill expecting only text output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown skill description directs the agent to write content to a specified output file, which affects user data on disk. The file description does not include any warning or disclosure about filesystem modification or overwriting behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This is a markdown file, so SQP-2 applies to whether the description warns about behaviors affecting user data or privacy. The 'User Login Sequence' section shows transmission of username/password and return of a JWT token, but the surrounding documentation provides no warning or caution about sensitive authentication data handling.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

other

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

External Script Fetching

External Script Fetching

TALA is a powerful diagram layout engine specifically designed for software architecture diagrams. It requires separate installation.

External Script Fetching

External Script Fetching

TALA 是一款专为软件架构图设计的图表布局引擎，非常强大，该引擎需要单独安装

Tp4

Context-Inappropriate Capability

Natural-Language Policy Violations

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Context-Inappropriate Capability

Natural-Language Policy Violations

Missing User Warnings

Context-Inappropriate Capability

Tainted flow: 'new_content' from pathlib.Path.read_text (line 18, file read) → pathlib.Path.write_text (file write)

Missing User Warnings

Missing User Warnings

Missing User Warnings