svg-primitives
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides a set of Python primitives for creating SVG diagrams. It uses standard libraries (drawsvg, svgpathtools, fontTools) for its core functionality. The documentation and scripts focus exclusively on geometric construction and validation, with no evidence of malicious intent or risky behaviors like unauthorized data access or obfuscation.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts text input for labels which are rendered into SVG format. While this provides a surface for indirect prompt injection if the resulting SVG is processed by an LLM, the risk is managed by the use of established libraries that handle XML sanitization.
- Ingestion points: Text parameters in LabeledBox, Diamond, Pill, Annotation, and Bracket classes located in scripts/svg_primitives/shapes.py and scripts/svg_primitives/annotations.py.
- Boundary markers: The skill relies on standard XML structural boundaries managed by drawsvg.
- Capability inventory: File writing is performed via the Canvas.save method in scripts/svg_primitives/canvas.py.
- Sanitization: Automatic XML entity escaping is provided by the underlying drawing and parsing libraries.
- [EXTERNAL_DOWNLOADS]: The skill documentation correctly identifies necessary system-level font dependencies and Python packages required for full functionality. These are standard requirements for font measurement and image conversion and do not involve untrusted sources.
Audit Metadata