xd-validate-svg
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the xd-extract package from the NPM registry via npx.
- [COMMAND_EXECUTION]: The skill executes shell commands to validate SVG files.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external SVG and JSON data, creating a potential injection surface. (1) Ingestion points: SVG and JSON files; (2) Boundary markers: None; (3) Capability inventory: Shell command execution; (4) Sanitization: None.
Audit Metadata