The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the Bash tool to perform image conversion tasks (SVG to PNG) by executing several third-party command-line utilities including resvg, sharp, cairosvg, and rsvg-convert.
[DYNAMIC_EXECUTION]: Shell commands for rasterizing icons are dynamically generated using variables like {SIZE} and {OUTPUT_DIR} derived from user-provided arguments. This pattern introduces a potential command injection risk if the agent does not properly sanitize or validate these parameters before passing them to the shell.
[EXTERNAL_DOWNLOADS]: The skill uses WebSearch and WebFetch to search for and download SVG assets from external sources such as lucide.dev, phosphoricons.com, and unpkg.com. These are well-known and standard services for design assets.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data by fetching SVG files from the internet. While SVGs are vector graphics files, they are XML-based and could theoretically contain malicious instructions embedded in metadata or comments intended to influence the agent during processing.
Ingestion points: Ingestion occurs in SKILL.md (Step 3) where the agent uses WebFetch to retrieve SVGs from external CDNs.
Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for the fetched external content.
Capability inventory: The skill possesses Bash and Write capabilities, used for processing and saving the retrieved assets.
Sanitization: The instructions do not mandate specific sanitization or validation of the fetched SVG code before the agent processes or renders it.

icon-craft