svg-to-png

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:02 AM UTC
• Version: 1.0.0

Overview

The skill appears to do only SVG-to-PNG conversion, but it relies on a reported vulnerable native image-processing dependency in the core conversion path.

Review before installing. The converter itself is simple and purpose-aligned, but avoid using this version on untrusted SVGs until sharp is updated to a non-vulnerable release and the lockfile is regenerated; consider running image conversion in a constrained environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The lockfile pins sharp to 0.34.5, and the supplied advisory data indicates known inherited vulnerabilities in bundled/native image-processing components such as libvips and libheif. Because this skill processes attacker-controllable SVG/image input, vulnerable image decoders/parsers can plausibly be reached during conversion, increasing the chance of denial of service, memory corruption, or other native-library exploitation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill depends on sharp 0.34.5, which is reported as affected by known vulnerabilities inherited from native image-processing libraries such as libvips and libheif. Because this skill's purpose is converting attacker-controlled SVG/image input, vulnerable parsing or decoding paths are especially relevant and could lead to denial of service, memory corruption, or other native-code exploitation depending on the underlying advisory details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description and all usage instructions are written entirely in Chinese, which imposes a specific language on users without any stated opt-in or justification. Under the policy, language constraints should either be optional for the user or clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency is specified with a caret range (^0.34.5), which allows installation of newer patch/minor releases instead of a fully locked version. This reduces build reproducibility and can unexpectedly introduce vulnerable or incompatible code through dependency drift, though by itself it is usually a supply-chain hardening issue rather than a direct exploit.

Content

Scanner excerpt · package.json (reported line 3)May include surrounding context.

json

{
  "dependencies": {
    "sharp": "^0.34.5"
  }
}