svg-article-illustrator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted user-provided Markdown files to extract illustration descriptions for its generation pipeline.
- Ingestion points: The agent reads a source article Markdown file (e.g., @path/to/article.md) specified by the user to identify key concepts and illustration placeholders.
- Boundary markers: The parallel generation instructions in references/multi-agent-generation.md do not define clear delimiters or "ignore" instructions for the Task Agents when processing descriptions extracted from the user's article.
- Capability inventory: The skill uses scripts/archive.sh (shell script) and scripts/svg2png.js (Node.js/Puppeteer), providing capabilities to write to the local filesystem and execute code via a browser environment.
- Sanitization: There is no evidence of sanitization or validation of the text extracted from the user's article before it is used to prompt Task Agents or rendered as SVG.
- [COMMAND_EXECUTION]: The skill relies on external scripts for its core functionality, executing scripts/archive.sh for SVG extraction and scripts/svg2png.js for PNG conversion.
- [DYNAMIC_EXECUTION]: The scripts/svg2png.js script uses the puppeteer library to render SVG content in a Chromium instance. Since SVG content can contain executable scripts, this provides a runtime environment where potentially malicious code could execute if the AI is tricked into generating it via indirect injection.
- [EXTERNAL_DOWNLOADS]: The skill documentation specifies requirements for installing external software, including Node.js and the puppeteer package, to enable the optional PNG export functionality.
Audit Metadata