SVG to Image

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:26 PM UTC
• Version: 1.1.1

Overview

The skill mostly does what it advertises, but converting untrusted SVG files is under-contained and could make the renderer access local or network resources.

Install only if you are comfortable running a local image converter on the SVGs you provide. Avoid converting SVG files from untrusted people unless the run is sandboxed with limited filesystem and network access, and prefer pinned dependency versions before broad use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/convert_svg.py:31
• Finding: Unrestricted External Resource Resolution in Untrusted SVG Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/convert_svg.py:31-51` **Vulnerability Type**: Unrestricted processing of attacker-controlled SVG resources **Risk Level**: Medium ### Vulnerable Code ```python if args.format == "png": cairosvg.svg2png( url=args.input, write_to=args.output, output_width=args.width, output_height=args.height, dpi=args.dpi, ) else: import io from PIL import Image buf = io.BytesIO() cairosvg.svg2png( url=args.input, write_to=buf, output_width=args.width, output_height=args.height, dpi=args.dpi, ) buf.seek(0) img = Image.open(buf).convert("RGB") img.save(args.output, "JPEG", quality=95) ``` ### Technical Analysis The converter passes a caller-selected SVG file directly to `cairosvg.svg2png()` without first parsing the document and rejecting external resource references. SVG documents may contain references to resources identified by network URLs or local file URLs. If the installed CairoSVG version and its resource-loading configuration resolve such references, conversion can cause the process to access resources outside the input document. No application-level URL allowlist, scheme validation, network isolation, local-file restriction, input size limit, or rendering resource limit is applied. The documented workflow also tells the agent to convert user-provided SVG files directly and without confirmation, increasing exposure to untrusted documents. This issue does not provide arbitrary command execution by itself. Exploitability and the exact resources accessible depend on CairoSVG's resource-loading behavior, the operating environment, filesystem permissions, network connectivity, and the contents of the crafted SVG. ## ...[truncated 1277 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every input SVG as untrusted. 2. Parse the SVG before rendering and reject references using `file:`, `http:`, `https:`, UNC paths, absolute paths, and other external schemes. 3. Permit only required inline content and, if necessary, carefully validated `data:` resources with strict media-type and size limits. 4. Configure a custom resource fetcher, where supported, that denies all external resource access by default. 5. Run conversion in an isolated worker with networking disabled and a minimal, read-only filesystem view containing only the input and output locations. 6. Execute the renderer as a dedicated unprivileged account with no access to credentials, home directories, cloud metadata, or internal administrative services. 7. Apply limits for input size, dimensions, DPI, processing time, memory, and output size. 8. Add security tests using SVG files that reference loopback URLs, private network ranges, cloud metadata addresses, and local files, verifying that conversion fails without making requests. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Unpinned Third-Party Dependencies Produce Non-Reproducible Installations<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```text cairosvg Pillow ``` The installation instruction in `SKILL.md:19` uses this mutable dependency specification: ```bash pip install -r requirements.txt ``` ### Technical Analysis Neither dependency has an exact version or an integrity hash. Each installation therefore resolves whichever releases satisfy the package names at that time. This makes the environment non-reproducible and prevents verification that installed artifacts are identical to versions reviewed and tested by the project. If a future release is compromised, maliciously replaced upstream, or introduces a security regression, users following the documented installation command may install it automatically. Python packages can execute code during build or installation, and both packages are imported into the conversion process at runtime. The reviewed package names are not apparent typos, and the project does not explicitly configure an untrusted package index. The finding concerns mutable dependency resolution and absent integrity verification rather than evidence that the current packages are malicious. ### Attack Path 1. A user follows the setup instructions and executes `pip install -r requirements.txt`. 2. Pip queries its configured package index and resolves the current available versions of `cairosvg` and `Pillow`. 3. Because no versions or hashes are specified, pip may select releases that were not reviewed with this skill. 4. A compromised release, compromised index response, or vulnerable future version is downloaded and installed. 5. Package-controlled code may execute during installation, import, image parsing, or SVG conversion. 6. Such code executes with the privileges of the user running pip or the conversion script. ### Impact Assessment The maximum impact is bounded by the privileges of ...[truncated 486 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to a reviewed exact version, for example with `package==X.Y.Z`. 2. Generate and commit cryptographic hashes for every permitted distribution and install with `pip --require-hashes`. 3. Include and pin transitive dependencies through a lock file generated by a tool such as `pip-tools`. 4. Regenerate the lock file through a controlled review process and test image conversion before accepting upgrades. 5. Explicitly use a trusted package index and disable unexpected supplemental indexes to reduce dependency-confusion exposure. 6. Prefer binary wheels from trusted sources where appropriate, and avoid running package installation with root or agent-wide privileges. 7. Integrate dependency vulnerability and provenance scanning into release maintenance. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- `cairosvg` (SVG rendering)
- `Pillow` (only for JPG output)

**Setup:** OpenClaw does not install Python packages automatically. After installing this skill, run once: `pip install -r requirements.txt` (from the skill folder). On Linux (e.g. Ubuntu/Debian), install the Cairo library first: `sudo apt install libcairo2`. If a script fails with `ModuleNotFoundError` or a cairo library error, install the missing package or system library.

## Usage

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp4

Low

• Category: MCP Least Privilege
• Confidence: 65% confidence
• Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

cairosvg
Pillow

• Confidence: 98% confidence
• Finding: The dependency cairosvg is unpinned, so installs may resolve to different versions over time, including versions with known denial-of-service and external resource handling issues. In a skill that converts attacker-supplied SVG content and has shell execution permission, dependency drift increases the chance of silently introducing exploitable parsing vulnerabilities into a high-risk input-processing path.

Unverifiable Dependency: cairosvg has 6 known advisory(ies) (CVE-2026-31899 (CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification); CVE-2021-21236 (Regular Expression Denial of Service in CairoSVG); CVE-2023-27586 (CairoSVG improperly processes SVG files loaded from external resources) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: CairoSVG has multiple known advisories, including denial-of-service and unsafe handling of external SVG resources, and the manifest does not specify a version, so a vulnerable release may be installed. This is especially dangerous here because the skill's purpose is to parse and render untrusted SVG input, making library flaws directly reachable by an attacker through normal use.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

cairosvg
Pillow

• Confidence: 98% confidence
• Finding: The dependency Pillow is unpinned, which makes builds non-reproducible and can pull in vulnerable or incompatible versions without notice. Because this skill processes image data and Pillow has a history of memory corruption and resource-consumption issues, leaving the version unconstrained exposes the image-conversion workflow to avoidable supply-chain and parser risk.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Pillow has numerous historical advisories, including resource-consumption and code-execution-class issues, and the lack of version pinning means the environment may resolve to an affected release. Since this skill converts files to PNG/JPG, Pillow is likely on the primary attack surface for untrusted image processing, so an unverified version materially increases risk.

Static analysis

No suspicious patterns detected.