technical-svg-diagrams
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided or generated SVG content. To mitigate potential risks associated with SVG files (such as embedded scripts), the
create-html.tsscript wraps the SVG in a Base64 data URI and renders it through an HTML<img>tag. This ensures the browser treats the content as an inert image, preventing script execution during the export process. - [COMMAND_EXECUTION]: The skill's export workflow utilizes several command-line utilities, including
bun,agent-browser,uvx, andcairosvg. These tools are used for their intended purposes: executing the conversion script, capturing screenshots, and processing image data. - [EXTERNAL_DOWNLOADS]: The documentation suggests using
uvxto runcairosvg. This involves downloading the library from the standard Python Package Index (PyPI).cairosvgis a well-known, established tool for SVG-to-raster conversion.
Audit Metadata