svg-to-png

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward SVG-to-PNG converter; the main things to notice are that it asks you to install the npm sharp library and writes PNG files to paths you provide.

This skill looks safe for normal SVG-to-PNG conversion. Before installing, be comfortable running npm install sharp in the working directory, and check the output filename so you do not accidentally overwrite an existing file.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill's dependency may add npm packages and native image-processing components to the current project or directory.

Why it was flagged

The skill requires installing a third-party npm dependency. This is purpose-aligned for image conversion, but users should recognize that npm installation changes the local environment and depends on external package provenance.

Skill content

在使用该技能前，需要在当前目录安装 sharp：

```bash
npm install sharp
```

Recommendation

Install dependencies in a project or sandbox you control, and prefer using the included package-lock/package.json workflow where possible.

Note

ASI02: Tool Misuse and Exploitation

What this means

A selected output path could be overwritten by the generated PNG.

Why it was flagged

The script writes an output file to the provided PNG path. This is exactly what the converter is meant to do, but users should be aware it can create or replace files at the chosen output location.

Skill content

await sharp(svgPath)
      .resize(size, size)
      .png()
      .toFile(pngPath);

Recommendation

Confirm the input and output paths before running the conversion, especially when using an existing filename.