SVG绘图工作台-智能生图

• Outcome: Review
• Latest audit: Sep 2, 2026 · 6:08 AM UTC
• Version: 1.2.0

Overview

The skill does what it says, but it needs Review because normal use can automatically install unpinned Python packages and render SVGs in an unsandboxed headless browser.

Install only if you are comfortable with the skill creating a local virtual environment and downloading Python packages during rendering. Prefer rendering SVGs you generated or trust, avoid hostile or unknown SVG files, and use a controlled environment if package-manager access or unsandboxed browser rendering is not acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

chk = subprocess.run([PYBIN, "-c", "import PIL"], capture_output=True)
    if chk.returncode != 0:
        log("[python] installing Pillow into isolated venv ...")
        r = subprocess.run([PIPBIN, "install", "-q", "Pillow"], capture_output=True, text=True)
        if r.returncode != 0:
            log("[python] Pillow install failed: %s" % (r.stderr or "")[-300:])
            return False

• Confidence: 82% confidence
• Finding: This code automatically installs `Pillow` at runtime by invoking `pip`, which introduces a supply-chain and unexpected code-execution risk if package indexes, TLS trust, or local pip configuration are compromised. In a skill context that processes untrusted content, silently fetching and executing third-party package installation steps increases attack surface beyond the animation task itself.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = [ff, "-y", "-framerate", str(fps), "-i", os.path.join(td, "f%05d.png"),
               "-pix_fmt", "yuv420p", "-vf", "scale=trunc(iw/2)*2:trunc(ih/2)*2",
               out_path]
        r = subprocess.run(cmd, capture_output=True, text=True)
        if os.path.exists(out_path) and os.path.getsize(out_path) > 0:
            return True
        log("[mp4] ffmpeg failed: %s" % (r.stderr or "")[-400:])

• Confidence: 84% confidence
• Finding: The script executes `ffmpeg` discovered via `PATH`, which can be hijacked if an attacker controls the environment or working context and places a malicious `ffmpeg` earlier in `PATH`. In agent or plugin environments, relying on ambient PATH resolution can turn a normal media export feature into arbitrary code execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def pip_install(pkg):
    py = ensure_venv()
    log("[python] installing %s into isolated venv ..." % pkg)
    r = subprocess.run([PIPBIN, "install", "-q", pkg], capture_output=True, text=True)
    if r.returncode != 0:
        log("[python] pip install %s failed: %s" % (pkg, (r.stderr or "")[-300:]))
        return False

• Confidence: 91% confidence
• Finding: This code performs a runtime `pip install` of packages, which executes package installation logic from external sources and expands the trust boundary from local rendering to arbitrary third-party code execution. If package indexes, dependencies, or network paths are compromised, the host running the skill could execute attacker-controlled code during install.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Chrome --headless=new with a fresh profile often writes the PNG
            # then lingers without exiting. So: watch for the file instead of
            # waiting for process exit, then kill the process ourselves.
            proc = subprocess.Popen(cmd, stdout=subprocess.PIPE,
                                    stderr=subprocess.PIPE)
            ok = False
            deadline = time.time() + 45

• Confidence: 89% confidence
• Finding: The script renders attacker-supplied SVG by embedding it into HTML and opening it in a headless browser with `--no-sandbox`. Untrusted SVG can contain active content or external resource references, and disabling the browser sandbox substantially increases the consequence of any browser rendering exploit or unsafe file/network access during rendering.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: Auto-installing Python packages at runtime extends the skill from local SVG rendering into network-enabled dependency retrieval and execution of third-party install code. In a security-sensitive environment, this creates a supply-chain execution path that is inconsistent with a narrowly scoped renderer.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.