Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

D2 Diagram Creator

v1.0.0

Generate D2 diagram code supporting flowcharts, system architecture diagrams, organizational charts, service topology diagrams, state machine diagrams, swiml...

0· 80·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for huta0kj/d2-diagram-creator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "D2 Diagram Creator" (huta0kj/d2-diagram-creator) from ClawHub.
Skill page: https://clawhub.ai/huta0kj/d2-diagram-creator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install d2-diagram-creator

ClawHub CLI

Package manager switcher

npx clawhub@latest install d2-diagram-creator
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to generate D2 diagrams and the repo contains detailed generator/validator guidance, which is coherent. However the SKILL.md and validator expect the 'd2' CLI (and optionally Tala) and to run 'd2' commands, yet the registry metadata declares no required binaries. At minimum the skill should declare 'd2' (and 'python' to run the helper script) as required binaries. The README also recommends piping an external install script (curl | sh) which is not reflected in install metadata.
!
Instruction Scope
Runtime instructions are largely scoped to files under <skill-base-path> and to invoking the d2 CLI to validate and export diagrams. However the validator explicitly instructs running the included scripts/remove_watermark.py to remove a Tala watermark and states this is mandatory for Tala SVGs. The skill tells the agent to run external CLI commands and a local Python script that is not shown here — running an opaque script that modifies output files raises risk (could alter files, remove attribution, or perform other actions). The SKILL.md otherwise does not ask the agent to read unrelated user files or secrets.
Install Mechanism
There is no formal install spec (instruction-only skill), which minimizes automatic disk writes. However README suggests installing D2 via piping an external script (curl -fsSL https://d2lang.com/install.sh | sh -s --). That install recommendation is high-risk behavior if the user follows it blindly. The included codebase itself has no heavy install step, but the skill expects an external binary to be present.
Credentials
The skill requests no environment variables, secrets, or config paths. It does not require any cloud credentials or unrelated tokens. This is proportionate to its stated purpose (diagram generation).
Persistence & Privilege
The skill is not always-enabled and does not request special privileges or claim to modify other skills or global agent settings. It will run CLI tools and a bundled Python script within the skill directory, which is normal for an instruction-only skill.
What to consider before installing
Key things to consider before installing or running this skill: - The SKILL.md/validator expect the 'd2' CLI (and optionally the Tala engine) and to run 'd2' commands, but the skill metadata does not declare required binaries — ensure you have d2 installed separately and that you trust the install source before running any 'curl | sh' installer. - The skill includes a scripts/remove_watermark.py and the validator forces running it to remove Tala watermarks. Inspect the full contents of that script before running it (look for network calls, file exfiltration, or unexpected behavior). If you are not comfortable, do not run it or run it in an isolated environment. - Avoid blindly executing remote install commands from README (curl | sh). Prefer reviewing the installer or using official package managers or vendor-provided packages. - If you want higher assurance, ask the publisher to: (1) declare required binaries (d2, python) in metadata, (2) include the full remove_watermark.py content in the skill description with an explanation of exactly what it changes, and (3) avoid mandating watermark removal or clearly explain legal/licensing implications. - If you share the contents of scripts/remove_watermark.py here (or allow me to inspect it), I can reassess and likely raise confidence to 'high' if it does only safe local SVG edits.

Like a lobster shell, security has layers — review code before you run it.

latestvk9736fefdm3xk8504nzny8a40n843cn7
80downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

D2 Diagram Creator

Three-agent pipeline for high-quality diagram generation:

AskUserQuestion → Agent 1 (Analyzer) → Agent 2 (Generator) → Agent 3 (Validator)

Each agent is a general-purpose subagent with its own focused instructions. You (the main agent) orchestrate the pipeline — ask the user questions, then spawn agents in sequence, passing outputs forward.


Step 1: Ask Requirements

Use AskUserQuestion to ask all questions at once. Do not split into multiple rounds, do not skip any.

First round (always required)

{
  "questions": [
    {
      "question": "How detailed should the diagram be?",
      "header": "Detail Level",
      "options": [
        { "label": "Core Flow", "description": "5-8 nodes" },
        { "label": "Moderate", "description": "10-15 nodes" },
        { "label": "Full Detail", "description": "Include all details and exception branches" }
      ]
    },
    {
      "question": "What is the layout direction of the diagram?",
      "header": "Layout Direction",
      "options": [
        { "label": "Horizontal", "description": "direction: right, left to right" },
        { "label": "Vertical", "description": "direction: down, top to bottom" }
      ]
    },
    {
      "question": "What format to export as?",
      "header": "Export Format",
      "options": [
        { "label": "D2 Code Only", "description": "No image export" },
        { "label": "SVG", "description": "Vector graphics (recommended)" },
        { "label": "PNG", "description": "Bitmap" },
        { "label": "Preview", "description": "ASCII text" }
      ]
    }
  ]
}

Second round (only when SVG/PNG is selected)

{
  "questions": [
    {
      "question": "Which theme to use?",
      "header": "Theme",
      "options": [
        { "label": "Light Theme", "description": "--theme 0, white background (default)" },
        { "label": "Dark Theme", "description": "--theme 200, dark background" }
      ]
    },
    {
      "question": "Enable hand-drawn sketch style?",
      "header": "Sketch",
      "options": [
        { "label": "No", "description": "Normal style (default)" },
        { "label": "Yes", "description": "--sketch, hand-drawn effect" }
      ]
    },
    {
      "question": "Choose layout engine?",
      "header": "Layout Engine",
      "options": [
        { "label": "dagre", "description": "Default, fast and efficient" },
        { "label": "elk", "description": "Complex diagrams, 100+ nodes" },
        { "label": "tala", "description": "Most powerful, SVG only, requires installation" }
      ]
    }
  ]
}

Only provide 2 theme options (Light/Dark). Do not add colorful, terminal, or other themes.


Step 2: Spawn Analyzer Agent

Use the Agent tool to spawn the requirements analyzer. This agent deeply analyzes the user's request and produces a structured JSON document.

  • subagent_type: general-purpose
  • description: Analyze diagram requirements

The prompt should be:

Read the file at <skill-base-path>/agents/analyzer.md for your instructions.

Analyze this diagram request:

User request: <user's original description>

User preferences:
- Detail level: <answer>
- Layout direction: <answer>
- Export format: <answer>
- Theme: <answer, or "not selected">
- Sketch: <answer, or "not selected">
- Layout engine: <answer, or "not selected">

Return the structured requirements JSON.

Save the returned JSON — you will pass it to the generator agent.


Step 3: Spawn Generator Agent

Use the Agent tool to spawn the D2 code generator.

  • subagent_type: general-purpose
  • description: Generate D2 diagram code

The prompt should be:

Read the file at <skill-base-path>/agents/generator.md for your instructions.

Generate D2 code based on these requirements:

<the requirements JSON from Step 2>

Read the diagram type guide at:
<skill-base-path>/references/diagram-types/<diagram_type>.md

Save the D2 code to a .d2 file (use a descriptive filename).
Return the file path.

Save the returned file path — you will pass it to the validator agent.


Step 4: Spawn Validator Agent

Use the Agent tool to spawn the validator.

  • subagent_type: general-purpose
  • description: Validate and export diagram

The prompt should be:

Read the file at <skill-base-path>/agents/validator.md for your instructions.

Your skill base directory is: <skill-base-path>
The watermark removal script is at: <skill-base-path>/scripts/remove_watermark.py

Validate and export:

D2 file: <path from Step 3>
Requirements: <the requirements JSON>

Export preferences:
- Format: <export_format>
- Theme: <theme or "default">
- Sketch: <sketch or false>
- Layout engine: <engine or "dagre">

Fix any issues and export the final diagram.

Report the validator's summary to the user.


Diagram Types Reference

TypeUse Case
FlowchartBusiness processes, decision trees, algorithm flows
System ArchitectureComponent relationships, infrastructure, service interactions
Organizational ChartHierarchical structures, reporting relationships
Service TopologyCloud architecture, network topology
State MachineState transitions, workflow states, lifecycles
Swimlane DiagramCross-functional processes, multi-role workflows
Sequence DiagramTime-based interactions, protocol flows
SQL Table DiagramDatabase schemas, ER diagrams
Grid DiagramDashboard layouts, UI prototypes

Prohibitions

  1. Do not skip requirement questions — always ask first
  2. Do not add visual styles unless the user explicitly requests them
  3. Do not add a diagram title unless the user explicitly requests one
  4. Do not skip any of the three agents — the pipeline must run to completion

Comments

Loading comments...