image-to-svg

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill implements runtime compilation of a local C source file (nn_assign.c) to accelerate pixel label assignment when a C compiler is available.
  • [COMMAND_EXECUTION]: The skill executes shell commands for environment setup including pip install and apt-get install, and uses subprocess.run to call the rsvg-convert utility for image conversion during verification.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves software packages from official public registries, specifically Python packages from PyPI and system libraries via the apt package manager.
  • [PROMPT_INJECTION]: The skill processes untrusted image data, which provides a potential surface for indirect prompt injection attacks.
  • Ingestion points: User-provided image files processed via the image_to_svg function as described in SKILL.md.
  • Boundary markers: No specific delimiters or instructions were identified to prevent the agent from following directions potentially embedded in processed image data.
  • Capability inventory: The skill has access to command execution (pip, apt, subprocess), runtime code compilation (gcc), and file system write operations.
  • Sanitization: The documented usage does not include explicit validation or sanitization steps for the input image content.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 11:48 PM
Security Audit — agent-trust-hub — image-to-svg