SVG to Image

PassAudited by ClawScan on May 1, 2026.

Overview

The skill coherently converts SVG files to PNG/JPG using a small local script, with only normal setup and shell-execution cautions.

This appears to be a straightforward local SVG-to-PNG/JPG converter. Before installing, be aware that it requires local Python dependencies and will run a conversion script when you ask it to convert an SVG; use trusted SVG inputs and choose safe output paths such as /tmp or ~/.openclaw/media/.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

When you ask for a conversion, the agent may run the local Python script and create an output image without an extra confirmation step.

Why it was flagged

The skill asks the agent to use shell execution and write an output file. This is expected for a local converter, but users should notice that conversion is performed automatically when requested.

Skill content

permissions:
  - shell:exec
...
When the user asks to convert an SVG to PNG or JPG ... run the script directly with `exec` ... Do not ask for confirmation; execute and return the image.

Recommendation

Use it for SVG files and output paths you intend to process; keep outputs in the recommended media or temporary directories.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing dependencies later may fetch newer package versions than the author tested.

Why it was flagged

The skill depends on external Python packages without version pins. These dependencies are appropriate for SVG-to-image conversion, but unpinned packages can change over time.

Skill content

cairosvg
Pillow

Recommendation

Install dependencies from trusted package indexes, and consider pinning versions if you need reproducible or controlled environments.