svg-composer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 3.3.2

Overview

This skill mostly does what it says, but its preview generator can write outside the chosen folder and create unsafe local HTML if given untrusted input.

Install only if you will use it on trusted inputs and controlled output folders. Avoid passing untrusted svg_list filenames, text, or SVG content to preview generation, do not share generated preview HTML that contains local file links, and consider pinning svgpathtools before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/svg_composer.py:858

Finding

Arbitrary File Write Through Unsanitized Preview Filenames

Content

View full analysis

" ) ``` 3. The function joins the malicious filename with `output_dir`. 4. The resulting path resolves outside the designated output directory. 5. The function opens that path in write mode and writes attacker-controlled content. 6. If the destination already exists, it is overwritten. ### Impact Assessment An attacker can create or overwrite files anywhere writable by the Python process. The exact scope is limited to the operating-system privileges of the process running the Skill; the code does not independently elevate privilege ...[truncated 403 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/svg_composer.py:870

Finding

Path Traversal and Stored HTML Injection Through Unsanitized Preview Text

Content

View full analysis

{title} ``` ```python

{title}

``` ```python # 保存 HTML html_filename = f"{text}_preview.html" if text else "preview.html" html_filename = html_filename.replace(' ', '_') html_filepath = os.path.join(output_dir, html_filename) with open(html_filepath, 'w', encoding='utf-8') as f: f.write(html_content) ``` ### Technical Analysis The caller-controlled `text` value is used in two security-sensitive contexts without context-specific validation: 1. It is inserted directly into the HTML `` and `<h1>` elements without HTML escaping. 2. It is incorporated into `html_filename` and written using `os.path.join()` without path confinement. Replacing spaces with underscores does not neutralize HTML metacharacters, absolute paths, directory separators, or `../` traversal sequences. Although `compose_text()` restricts supported characters when it is invoked, `generate_preview_html()` can be called with both `svg_list` and `text`. In that execution path, `text` is not passed through character-set validation before reaching the HTML and filesystem sinks. The generated preview also embeds `svg_content` directly into the HTML: ```python preview_items_html += f''' <div class="preview-item"> <h3>{'横向' if label == 'horizontal' else '纵向'}</h3> <div class="svg-wrapper"> {svg_content} </div> </div> ''' ``` Therefore, untrusted custom `svg_list` cont ...[truncated 1663 chars]

Remediation

View remediation

` rather than embedding arbitrary SVG markup directly into the HTML DOM. 7. Apply a restrictive Content Security Policy, such as disallowing scripts and remote connections, as defense in depth. 8. Use separate variables for display labels, filenames, URL attributes, and raw SVG; validate or encode each according to its output context. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/svg_composer.py:489

Finding

Unbounded Combinatorial Generation Allows Resource Exhaustion

Content

View full analysis

Remediation

View remediation

MAX_OUTPUTS: raise ValueError("Requested combination count exceeds the configured limit") ``` 2. Use `math.factorial()` or permutation-count calculations to validate permutation requests before iteration. 3. Enforce strict limits on: - Input character count. - Combination or permutation length. - Total output count. - Per-output and aggregate byte size. - Execution time and disk use. 4. Return or consume generators incrementally instead of storing all SVG documents in a list. 5. Avoid materializing `combinations` in `batch_compose()`; iterate over `comb_iter` directly. 6. Do not print complete combination lists. Log only bounded summaries and counts. 7. Run externally submitted generation jobs with memory, CPU, file-count, and disk quotas. 8. Support cancellation and deadlines for long-running batch operations. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:350

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring says svg_list elements are '(名称, svg字符串)', i.e. 2-tuples, but the implementation iterates 'for label, filename, svg_content in svg_list', requiring 3-tuples. This is an active contradiction in the inline documentation and can mislead developers into passing the wrong structure, causing runtime errors or incorrect use of the preview feature.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The docstring says the function is equivalent to loading a symbol directory with 'load_symbols(symbol_dir)', but the actual parameter is 'symbol_files', a dict mapping each character to a specific SVG file path, which the code reads one by one. This is a direct intent/documentation mismatch rather than merely omitted detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly promotes bulk generation of SVGs and creation of preview HTML containing download links and file:/// folder links, but it does not warn users about disk usage, accidental large-output generation, or local path exposure when the preview HTML is shared or opened in sensitive environments. While this is not an exploit by itself, it can lead to unintended local information disclosure and resource consumption, especially when combined with combinatorial modes that may generate very large numbers of files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code file contains natural-language content entirely in Chinese in the module docstring and comments, which imposes a specific language/locale on readers and maintainers without any opt-in or justification. Under the policy, language-specific constraints should either offer a choice or be clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring and data section present this file as built-in charset data for supported characters, but SUPPORTED_SYMBOLS lists additional symbols such as :, `, {, |, }, and ~ that do not appear as keys in SVG_ALPHABET. ALL_SUPPORTED is then derived from these support lists, so the code advertises support beyond what the actual glyph dataset contains.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code creates the output directory and later writes multiple SVG files into it, which is a safety-relevant file-write operation. While there are progress print statements, there is no user-facing warning or confirmation that existing files in the target directory may be created or overwritten as part of batch generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The preview generator writes attacker-influenced SVG/HTML files to disk and builds clickable local file:// links, which can make unsafe content easier to open in a browser. In this skill context, SVG content may include active or browser-sensitive constructs if sourced externally, so generating and encouraging interaction with local files expands the attack surface to stored client-side content execution or local-file phishing/trust abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML template sets <html lang="zh">, which forces a specific locale in generated output. There is no option for callers to choose the language or locale, and the function can be used with arbitrary text rather than a clearly China-specific compliance context.

Content

No source excerpt is available for this finding.