image-to-svg
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill implements runtime compilation of a local C source file (
nn_assign.c) to accelerate pixel label assignment when a C compiler is available. - [COMMAND_EXECUTION]: The skill executes shell commands for environment setup including
pip installandapt-get install, and usessubprocess.runto call thersvg-convertutility for image conversion during verification. - [EXTERNAL_DOWNLOADS]: The skill retrieves software packages from official public registries, specifically Python packages from PyPI and system libraries via the apt package manager.
- [PROMPT_INJECTION]: The skill processes untrusted image data, which provides a potential surface for indirect prompt injection attacks.
- Ingestion points: User-provided image files processed via the
image_to_svgfunction as described in SKILL.md. - Boundary markers: No specific delimiters or instructions were identified to prevent the agent from following directions potentially embedded in processed image data.
- Capability inventory: The skill has access to command execution (pip, apt, subprocess), runtime code compilation (gcc), and file system write operations.
- Sanitization: The documented usage does not include explicit validation or sanitization steps for the input image content.
Audit Metadata