The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests external data (PNG files) and utilizes variables like INPUT_PNG and OUTPUT_SVG within shell command blocks, creating a surface for potential injection if filenames are maliciously crafted.
Ingestion points: INPUT_PNG (referenced in SKILL.md and README.md).
Boundary markers: None present to delimit untrusted file data or paths.
Capability inventory: Executes subprocesses via magick, vtracer, npx svgo, and rm.
Sanitization: No explicit sanitization or validation of file paths or input parameters is described in the instruction set.
[COMMAND_EXECUTION]: The skill relies on executing shell commands to perform image processing tasks. This includes file system operations like removing temporary files (rm -f).
[EXTERNAL_DOWNLOADS]: The documentation encourages the installation of third-party tools from well-known package managers including Homebrew (imagemagick), Cargo (vtracer), and NPM (svgo). It also references the author's own skill management tool via npx lovstudio.

lovstudio-png2svg