The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions and command-line templates for the agent to invoke local rendering tools like resvg, rsvg-convert, inkscape, and cairosvg to convert SVG designs into raster formats (PNG). This is an intended and documented part of the skill's export workflow.
[EXTERNAL_DOWNLOADS]: Documentation in references/exports.md mentions using npx to execute the @resvg/resvg-js-cli tool from the npm registry. While this involves fetching code at runtime, the package is a well-known utility relevant to the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied branding and text to populate SVG elements. As there are no explicit sanitization rules or instructions to handle special markup characters, this creates an attack surface where malicious input could lead to the generation of SVGs containing unwanted elements (such as script tags) if the output is rendered in a script-enabled context.
Ingestion points: User-provided content (Brand Name, Taglines) identified in the intake section of SKILL.md.
Boundary markers: None present; the skill lack explicit instructions to delimit or ignore embedded commands in user data.
Capability inventory: The agent is empowered to execute shell commands for image export as described in references/exports.md.
Sanitization: No validation or escaping of user input is specified before it is interpolated into the SVG <text> elements.

svg-banner-designer-acrazie