creating-svg-assets
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves executing Node.js scripts (
scripts/optimize-svg.js,scripts/svg-to-png.js) and installing global packages via npm. - [INDIRECT_PROMPT_INJECTION]: The skill processes SVG content which can serve as a vector for indirect prompt injection.
- Ingestion points: SVG markup is created and modified as part of the workflow in SKILL.md.
- Boundary markers: No markers or safety warnings are provided to isolate the processed SVG data from the agent instructions.
- Capability inventory: The skill uses node for script execution and npm for dependency management.
- Sanitization: Relies on svgo for optimization, which is not designed to filter prompt injection payloads.
Audit Metadata