The Agent Skills Directory

[SAFE]: The skill implements a comprehensive local designer tool for SVG recoloring and raster vectorization (Image Trace). All image processing is performed locally in the browser's canvas or via the included Node.js scripts.
[DATA_EXFILTRATION]: No evidence of sensitive data access or external transmission was found. The Node.js server (scripts/server.mjs) includes a path-traversal guard (normalize(join(root, p))) to prevent access to files outside the specified assets directory.
[REMOTE_CODE_EXECUTION]: The skill does not perform remote script execution or download untrusted code. External dependencies like sharp are well-known industry standards for image processing.
[EXTERNAL_DOWNLOADS]: The studio UI (assets/index.html) references Google Fonts, which is a well-known and trusted service. These references do not pose a security risk to the agent environment.
[OBFUSCATION]: Analysis of all scripts and assets, including embedded Base64 strings for fallback graphics, revealed no hidden instructions or malicious obfuscation techniques.
[COMMAND_EXECUTION]: The skill includes Node.js scripts (server.mjs and trace.mjs) intended for local execution by the user or agent. These scripts perform the described functions (serving static files and tracing images) without unauthorized side effects.

svg-brand-tint-ops