image-to-vector

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/vectorize-image.py executes external binaries such as vtracer, magick (ImageMagick), and svgo using subprocess.run(). It follows security best practices by passing arguments as a list and avoiding the use of shell=True, which effectively mitigates command injection risks.\n- [EXTERNAL_DOWNLOADS]: The skill contains logic in svgo_command to utilize npx --yes svgo to download and execute the svgo optimizer from the official npm registry if it is not found on the local path. This is a standard practice for managing lightweight dependencies in development environments.\n- [SAFE]: The skill adheres to best practices for local file manipulation and tool wrappers. It utilizes pathlib for secure path resolution and implements specific validation logic to ensure that vectorization parameters (e.g., speckle filter, segment length) remain within the safe bounds expected by the underlying engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 09:16 PM
Security Audit — agent-trust-hub — image-to-vector