vectorize

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script executes multiple system commands using subprocess.run with argument lists, which prevents shell injection. It orchestrates uv for environment management, brew for library path discovery, npx for SVG optimization, and potrace for bitmap tracing.
  • [EXTERNAL_DOWNLOADS]: The skill installs Python dependencies (vtracer, pillow, cairosvg) from the Python Package Index (PyPI) and fetches the svgo tool via npx from the npm registry. These are well-known and trusted package repositories.
  • [DYNAMIC_EXECUTION]: The script generates a small Python snippet at runtime to perform SVG-to-PNG verification using cairosvg. The execution uses subprocess.run and passes arguments safely via sys.argv.
  • [SAFE]: The skill's operations are transparently documented and aligned with its stated purpose of vectorization. The use of a virtual environment to sidestep known library bugs demonstrates appropriate development practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 01:42 AM