diagram-gen

SUSPICIOUS: the core capability is plausible for a diagram-generation skill, but the skill is internally incomplete about where source code goes and who publishes the executed `npx` package. Risk is moderate due to remote package execution plus credential use, not because of clear malicious behavior.