The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render.mjs executes the static shell command npm root -g to locate global Node.js packages. This is a standard environment-discovery operation and does not involve user-supplied input.
[EXTERNAL_DOWNLOADS]: The skill requires the standard, well-known Node.js packages playwright or playwright-core to render SVG files into PNG format. These are established industry-standard tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes user prompts to generate SVG code, creating a potential attack surface for indirect prompt injection. However, this is mitigated by the scripts/lint.mjs tool, which enforces strict security rules by checking for and blocking dangerous SVG features such as <script> tags, <foreignObject> elements, and external URL references.
[SAFE]: No malicious patterns or data exfiltration attempts were identified. The skill follows secure design principles by providing tools for both generating and validating content within a restricted environment.

illustration-grainy-gouache