SVG to Image

Convert SVG to PNG or JPG for quick sharing (e.g. Telegram) or print.

This skill is functionally what it says, but review these points before installing: (1) You must install cairosvg, Pillow, and system libcairo2 yourself; install from official sources (pip, distro repos). (2) The agent will run the included Python script automatically (no confirmation) when asked to convert; make sure you trust the input. (3) SVGs can reference external resources — cairosvg may fetch them, which could leak requests to internal services (SSRF) or cause outbound network activity. Avoid converting untrusted or unknown SVGs, or run the skill in a sandboxed environment. (4) Follow the SKILL.md instruction to write output to allowed media dirs (/tmp or ~/.openclaw/media/) so the agent can send the file. If you want stronger guarantees, consider modifying the script to disable URL fetching or validate/clean SVG inputs before rasterizing.

Type: OpenClaw Skill Name: svg-to-image Version: 1.1.1 The skill is classified as suspicious due to its use of the high-risk `shell:exec` permission and instructions in `SKILL.md` that constitute a prompt injection against the agent, telling it to 'run the script directly' and 'Do not ask for confirmation'. While the script `scripts/convert_svg.py` itself appears to perform its stated function without explicit malicious code (e.g., no data exfiltration, network calls, or persistence mechanisms), processing user-supplied file paths and SVG content carries inherent vulnerabilities like potential path traversal or resource exhaustion. The prompt injection aims to streamline the intended (benign) operation, not to hide malicious activity, but it bypasses agent safeguards.