stack-diagram
An agent skill that draws cloud-architecture-style diagrams of tech stacks, with official brand logos, grouped containers and orthogonal arrows. Output is self-contained HTML, a PNG, a React/TSX component, or an artifact. It can optionally post the diagram to a public gallery.
What it can touch
| files | write, including ~/.fonts |
|---|---|
| network | api.github.com, api.svgl.app, aws.amazon.com, cdn.jsdelivr.net, challenges.cloudflare.com, d1.awsstatic.com, developer.mozilla.org, developers.cloudflare.com, docs.oasis-open.org, dpgr.am, en.wikipedia.org, evil.example, evil.test, gallery.test, github.com, knowledge.digicert.com, ldapwiki.com, orpc.unnoq.com, pptr.dev, raw.githubusercontent.com, skills.sh, stacks.caru.moe, support.cloudflare.com, svgl.app, svgl.app.evil.test and 5 more |
| shell | runs commands |
| secrets | none found |
What it actually does
SKILL.md tells the agent to run a set of Python scripts. - `fetch_icons.py` downloads logos from svgl.app, devicon/gilbarbara (raw.githubusercontent.com, cdn.jsdelivr.net), AWS's icon package, or an explicit URL. - `build.py` inlines the icons and bundled fonts into an HTML template. - `render_png.py` screenshots the HTML with headless Chromium through Playwright. It runs `fc-list` and launches Chromium with `--no-sandbox`. If `/tmp/libs/usr/lib/*` exists, it prepends those folders to LD_LIBRARY_PATH. - Step 7 is optional and consent-gated. `share.py` uploads the light and dark PNGs, a title, the stack list, a display name and, if the user agrees, a GitHub login to https://stacks.caru.moe, then saves a delete key locally. The agent must offer sharing only once, show exactly what will be sent, warn about internal hostnames and IPs, and get two explicit yeses. It may run `gh api user -q .login` only to offer the login, and only include it if the user agrees. The bundle also contains the gallery's server code (Cloudflare Worker, `site/`). That code runs on the author's infrastructure, not on the user's machine. `fetch_icons.py`, `build.py` and `share.py` were left out of the bundle, so their exact behavior was not reviewed. No hidden text, prompt injection or credential harvesting was found in the files shown.
What the check found
mediumDownloads programs or archives while running
Files fetched at run time weren't part of this check, and they can change at any time.
site/src/features/gallery/components/hero.tsx:12 const ZIP_URL = `${REPO_URL}/releases/latest/download/stack-diagram.zip`;
mediumRuns code that is built while it runs
eval, exec and new Function run text as code, which makes it hard to know what will actually run.
site/worker-configuration.d.ts:3178 * The **`exec()`** method of the URLPattern interface takes a URL or object of URL parts, and returns either an object containing the results of matching the UR
site/worker-configuration.d.ts:3182 exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
site/worker-configuration.d.ts:3478 exec(cmd: string[], options?: ContainerExecOptions): Promise<ExecProcess>;
mediumDownloads programs or archives while running
Files fetched at run time weren't part of this check, and they can change at any time.
skills/stack-diagram/scripts/render_png.py:19 apt-get download libxdamage1 && dpkg -x libxdamage1_*.deb /tmp/libs
skills/stack-diagram/scripts/render_png.py:55 " apt-get download fonts-noto-cjk && dpkg -x fonts-noto-cjk_*.deb /tmp/fontx\n"
mediumOptional upload of diagrams to a third-party public gallery
Step 7 has the agent upload the rendered PNGs, a title, the tech stack, a display name and, optionally, a GitHub login to the author's gallery. Diagrams can reveal internal architecture. The instructions are careful about this: the agent offers once, shows the full payload, warns about hostnames and IPs, and sends only after two explicit confirmations. However, the uploading script `share.py` was not included in the bundle, so what it actually sends could not be verified.
skills/stack-diagram/SKILL.md:109 Offer this only where you can run shell commands with network access; otherwise skip the step. After delivering, add one line in the user's language offering to
skills/stack-diagram/SKILL.md:124 python3 scripts/share.py submit out.png out-dark.png --title "..." --stack "..." --name "..." [--github LOGIN] [--icons DIR]
skills/stack-diagram/SKILL.md:121 Point out anything that looks internal — hostnames, IPs, customer or company names, internal service names — and suggest re-rendering without it first. Ask them
mediumOptional upload of diagrams to a third-party public gallery by a script that could not be reviewed
Step 7 has the agent offer to upload the rendered diagrams and metadata to the author's gallery (stacks.caru.moe). The instructions require explicit consent, a preview of everything sent, a warning about internal hostnames and IPs, and a second confirmation. That is well designed. However, share.py was omitted from the bundle, so nobody could check that it sends only what the instructions describe. Architecture diagrams can expose internal systems. A reviewer should read share.py before listing.
skills/stack-diagram/SKILL.md:124 python3 scripts/share.py submit out.png out-dark.png --title "..." --stack "..." --name "..." [--github LOGIN] [--icons DIR]
skills/stack-diagram/SKILL.md:109 Offer this only where you can run shell commands with network access; otherwise skip the step. After delivering, add one line in the user's language offering to
Keep an eye on it
This check is of one commit. Watch stack-diagram and we'll email you if a later commit changes what it can touch.
Made this? Add the badge
[](https://plugsday.com/tools/caru-ini-stack-diagram)About this check
Checked November 2, 2026 at commit 9e90a3b286ba, 238 files. Rules for known red flags, then two Claude reviews, one of them told to assume the author is malicious. A later commit hasn't been checked. How checks work.