SVG Artist

Generate SVG images using text LLM instead of image generation APIs. Use when user wants to create illustrations, icons, cartoons, diagrams, or any visual co...

This skill appears to do what it says (have the LLM produce SVG and convert it to PNG), but take these precautions before installing or using it: - Runtime requirements: Ensure Node.js and an SVG-to-PNG tool (rsvg-convert or ImageMagick's convert) are available — the skill does not declare these but its code and docs require them. - Review the script: The helper uses execSync with string-interpolated commands. If the agent, user, or LLM can control filenames or injected content, that could be exploited (command injection). If you plan to run this in a multi-user or untrusted-input context, request the maintainer to sanitize inputs and use safer APIs (child_process.execFile/spawn with arg arrays, or avoid shell interpolation). - File handling: The script writes to /tmp and creates .svg/.png files. Confirm that this behavior is acceptable in your environment and that sensitive data won’t be written there. - If you are the developer or operator: add required-binaries to metadata (node, rsvg-convert/convert), validate/sanitize filenames, avoid node -e with untrusted content, and prefer safe temporary-file APIs. Given these issues the skill is not evidently malicious, but the missing dependency declarations and the shell-exec patterns make it worth extra caution (hence 'suspicious'). If the author provides updated metadata and safer exec usage, this could be re-classified as benign.

Type: OpenClaw Skill Name: svg-artist Version: 1.0.0 The skill enables SVG-to-PNG conversion but contains a shell injection vulnerability in `scripts/generate_svg.js` due to the use of `execSync` with unsanitized command-line arguments (file paths). While the instructions in `SKILL.md` describe a legitimate workflow for generating illustrations, the helper script's implementation allows for arbitrary command execution if malicious paths are provided to the conversion utilities.