image-to-vector
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/vectorize-image.py executes external utility binaries including vtracer, magick (ImageMagick), and svgo. The execution is handled through the run_command function, which uses subprocess.run with argument lists rather than shell strings, preventing shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted external data (raster images) and parses the generated SVG output using regular expressions to provide complexity metrics to the agent. The risk is minimized as the parsed data is used solely for metadata metrics and is not interpolated into executable logic or sent to non-whitelisted network endpoints.
Audit Metadata