The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script scripts/render_icon.py is designed to invoke several external rendering tools such as rsvg-convert, resvg, cairosvg, inkscape, magick, and qlmanage. These calls are executed via subprocess.run using argument lists, which is a secure practice that prevents shell command injection vulnerabilities.
[COMMAND_EXECUTION]: The SKILL.md file instructs the agent to execute a linter script check_svg.py from a relative directory (../icon-draw/scripts/). This indicates a functional dependency on a sibling skill to perform security validation.
[SAFE]: The skill enforces a security-conscious workflow by requiring a linter to check SVG inputs for dangerous features like external entities, scripts, and DOCTYPE declarations before they are processed by renderers. This specifically mitigates common SVG-based attack vectors such as SSRF and XML bombs.

icon-critique