svg-figure
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The documentation provides example shell commands using
uv runto execute scripts with specific Python dependencies (drawsvg,svgpathtools,Pillow,fonttools,cairosvg,lxml). These are common, reputable packages for scientific and graphics processing. - [DYNAMIC_EXECUTION]: The script
examples/schematic_from_primitives.pydynamically modifiessys.pathto include a sibling skill directory (svg-primitives/scripts). This is a legitimate technique for local module resolution within the agent's plugin structure and does not involve untrusted input. - [INDIRECT_PROMPT_INJECTION]: The skill processes user descriptions to generate SVG schematics. While this involves interpreting untrusted user input, the scope is limited to SVG generation and the skill provides clear authoring conventions and reference scripts to ensure output consistency and safety. Ingestion points include user prompts for figure creation (SKILL.md); however, no unsafe interpolation or sanitization bypasses were observed.
Audit Metadata