SVG Cover Generator

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:00 AM UTC
• Version: 0.1.0

Overview

This is a coherent SVG cover-generation skill with templates and a local validator; the validator is useful but not a complete SVG security sanitizer.

Installers should treat this as a design-generation helper, not a security boundary. It does not show hidden persistence, credential access, or network behavior, but users should be cautious when opening SVGs from untrusted sources because the included validator only performs basic structural checks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_svg.py:38

Finding

Incomplete Detection of External SVG Resources

Content

View full analysis

Vulnerability Details

File Location: scripts/check_svg.py, lines 38–49
Vulnerability Type: Incomplete validation of externally referenced SVG resources
Risk Level: Medium

Vulnerable Code

python

for element in root.iter():
    name = local_name(element.tag)
    if name in DISALLOWED_TAGS:
        errors.append(f"Disallowed tag found: <{name}>")
    if name == "image":
        href = element.attrib.get("href") or element.attrib.get("{http://www.w3.org/1999/xlink}href")
        if href and (href.startswith("http://") or href.startswith("https://")):
            errors.append("Remote image reference found in <image>.")
    if name == "text" and (element.text or "").strip():
        text_nodes += 1

Technical Analysis

The validator checks remote href values only when the current element is an <image>. SVG documents can reference external resources through other constructs, including <use> and <feImage> elements, as well as CSS or presentation attributes containing url(...).

Consequently, an SVG can contain a remote reference while satisfying every implemented validation requirement. This conflicts with the skill's stated guarantee that generated artwork has no external asset references and is self-contained.

The URL comparison is also narrowly limited to literal lowercase http:// and https:// prefixes. It does not account for protocol-relative URLs, case variations, leading whitespace, or external references expressed through CSS.

Attack Path

1. An attacker or untrusted generation source supplies an SVG with the required root element, dimensions, viewBox, and a non-empty <text> node.

2. The SVG embeds an external reference outside an <image> element, for example:

   svg

   <use href="https://attacker.example/remote.svg#object"/>
   

3. validate_svg() does not inspect this href because the element name is use.

4. The validator returns no error and reports the SVG as structurally valid.

5. A ...[truncated 890 chars]

Remediation

View remediation

Remediation Suggestions

1. Inspect href and namespaced xlink:href attributes on every SVG element rather than only <image>.
2. Adopt an allowlist that permits only local fragment references such as #local-id where external resources are unnecessary.
3. Reject absolute URLs, protocol-relative URLs, and unsupported URI schemes after trimming whitespace and normalizing the scheme.
4. Inspect all presentation attributes and <style> content for external url(...) references.
5. Cover relevant resource-bearing elements, including <use>, <feImage>, and any other supported SVG elements capable of resolving URLs.
6. Add regression tests for:
   • Remote references in <use> and <feImage>.
   • External CSS url(...) values.
   • Protocol-relative URLs.
   • Mixed-case schemes.
   • Leading whitespace and encoded URL variants.
   • Valid local fragment references.
7. Consider processing untrusted SVG files in a renderer configured to deny network access, providing defense in depth if validation is bypassed.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose says the skill creates polished, editable SVG cover artwork. The supplied code does not create, edit, or render artwork at all. It only validates an input SVG file's structure and flags issues such as missing dimensions, missing viewBox, disallowed tags, remote image references, and missing text nodes. This is a materially different primary purpose from artwork generation, so the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

# SVG Cover Generator

Create polished, editable SVG cover artwork for reports, articles, slide decks, social cards, posters, ebook covers, and hero images.

This repository contains a Codex skill plus reusable SVG templates and validation tooling.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says to use the skill when a user asks for an 'SVG cover,' 'vector poster,' 'title card,' 'thumbnail-style artwork,' or 'branded cover image.' Several of these phrases are generic creative-design requests rather than narrowly scoped triggers, and the file provides no exclusion conditions or negative examples to clarify when this skill should not activate.

Content

No source excerpt is available for this finding.