The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md directly interpolate user-provided variables (INPUT_PNG, OUTPUT_SVG) into shell commands without quoting or sanitization. This creates a surface for command injection if a user provides a malicious file path (e.g., including ; or backticks).
Ingestion points: The variables INPUT_PNG and OUTPUT_SVG are extracted from user input.
Boundary markers: Absent. There are no instructions or delimiters provided to treat these variables as literal strings or to ignore embedded shell metacharacters.
Capability inventory: The skill utilizes the Bash tool to execute magick, vtracer, npx, and rm commands in SKILL.md.
Sanitization: No sanitization, escaping, or shell-quoting is applied to the input variables before they are passed to the shell.

lovstudio-png2svg