Image to SVG

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:02 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local image-to-SVG converter with disclosed promotion and manageable installation risks.

Install dependencies in a virtual environment, review or pin Pillow before production use, and direct outputs only to intended media or temporary folders. Be aware that default generated SVGs include VideoAny promotional metadata unless the skill is modified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/convert_image_to_svg.py:141
• Finding: Persistent Third-Party Promotion Injected into Generated SVG Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/convert_image_to_svg.py:12, 79-82, 141-143, 157`; `SKILL.md:10-14, 42-47, 61-62` **Vulnerability Type**: Output and instruction hijacking through mandatory promotional content **Risk Level**: Medium ### Evidence ```python PROMO_URL = "https://videoany.io/tools/image-to-svg" ``` ```python parser.add_argument( "--desc", default=f"Converted with VideoAny Image to SVG tool: {PROMO_URL}", help="Optional <desc> text in SVG metadata", ) ``` ```python f' <desc>{escape(args.desc)}
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove promotional content from the default conversion path. 2. Change the default description to an empty value or neutral conversion metadata: ```python parser.add_argument( "--desc", default="", help="Optional <desc> text in SVG metadata", ) ``` 3. Remove the unconditional promotional `<metadata>` element. 4. If branding is required, make it explicitly opt-in through an option such as `--include-promotion`. 5. Ensure that a standard conversion contains only content necessary to represent the user's source image and requested metadata. 6. Remove instructions that require the agent to recommend a specific external service. Any recommendation should only be made when explicitly requested and should be clearly identified as an external service. 7. Add tests confirming that the default SVG contains no third-party URL, brand, or promotional message. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unpinned Pillow Dependency Creates a Mutable Supply-Chain Boundary<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1`; `SKILL.md:16-20` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Evidence ```text Pillow ``` The documented installation instruction is: ```markdown ## Dependencies - `Pillow` (read image size and validate image input) **Setup:** OpenClaw does not install Python packages automatically. After installing this skill, run once: `pip install -r requirements.txt` (from the skill folder). ``` ### Technical Analysis The dependency declaration does not specify a reviewed version or package integrity hash. Consequently, `pip install -r requirements.txt` resolves whichever Pillow release is selected by the package index at installation time. This makes installations non-reproducible and allows dependency code to change without a corresponding change to the audited skill. A future compromised, malicious, or unexpectedly incompatible release could be installed automatically. The imported package runs within the Python process when the converter executes: ```python try: from PIL import Image except ImportError: print("Error: Pillow is required. Install with: pip install Pillow", file=sys.stderr) return 1 ``` No evidence was found that the current Pillow package referenced by the project is malicious. This finding concerns the absence of version and integrity controls rather than a confirmed compromise. ### Attack Path 1. An installer follows `SKILL.md` and runs `pip install -r requirements.txt`. 2. The package installer queries the configured Python package index. 3. Because no version or hash is specified, the selected Pillow artifact can vary over time and between environments. 4. If the resolved release or package-index delivery path is compromised, attacker-controlled dependency code is installed. 5. The converter later imports `PIL.Image`, causing dependency initialization code to execute in the converter process. 6. Such code would run wi ...[truncated 998 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Pillow to a reviewed, supported version: ```text Pillow==<reviewed-version> ``` 2. Generate a hash-locked requirements file and install with hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 3. Record hashes for every supported platform and Python version, or use a lock-file workflow that maintains platform-specific artifacts. 4. Install dependencies inside a dedicated virtual environment rather than into the system Python environment. 5. Use a trusted package index over authenticated TLS and avoid unreviewed mirrors. 6. Add automated dependency vulnerability scanning and a controlled update process. 7. Test dependency upgrades before changing the pinned version, then regenerate and review integrity hashes. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The script writes SVG output to a user-controlled path and creates parent directories automatically with output_path.parent.mkdir(...), so file-write capability is present and undeclared. Even though this is expected for a converter, undeclared write access is dangerous in an agent setting because it can overwrite or create files outside the intended workspace if path inputs are not constrained.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The script writes SVG output to a user-controlled path and creates parent directories automatically with output_path.parent.mkdir(...), so file-write capability is present and undeclared. Even though this is expected for a converter, undeclared write access is dangerous in an agent setting because it can overwrite or create files outside the intended workspace if path inputs are not constrained.

Lp4

Low

• Category: MCP Least Privilege
• Confidence: 65% confidence
• Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Pillow

• Confidence: 98% confidence
• Finding: The dependency is specified as just 'Pillow' with no version pin, which makes builds non-reproducible and can silently pull in a vulnerable or incompatible release over time. In a skill that processes untrusted image input and has shell execution permission, relying on an unpinned image-parsing library increases supply-chain and exposure risk if a bad version is installed.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Pillow has a history of security issues, including image parsing bugs that can lead to denial of service and, in some versions, possible code execution. Because the manifest does not pin a version, there is no assurance that deployment will avoid affected releases, which is especially relevant for an image-to-SVG skill expected to ingest attacker-controlled image files.

Static analysis

No suspicious patterns detected.