vectorize
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script executes multiple system commands using
subprocess.runwith argument lists, which prevents shell injection. It orchestratesuvfor environment management,brewfor library path discovery,npxfor SVG optimization, andpotracefor bitmap tracing. - [EXTERNAL_DOWNLOADS]: The skill installs Python dependencies (
vtracer,pillow,cairosvg) from the Python Package Index (PyPI) and fetches thesvgotool vianpxfrom the npm registry. These are well-known and trusted package repositories. - [DYNAMIC_EXECUTION]: The script generates a small Python snippet at runtime to perform SVG-to-PNG verification using
cairosvg. The execution usessubprocess.runand passes arguments safely viasys.argv. - [SAFE]: The skill's operations are transparently documented and aligned with its stated purpose of vectorization. The use of a virtual environment to sidestep known library bugs demonstrates appropriate development practices.
Audit Metadata