Skills create-svg-from-prompt
📦

create-svg-from-prompt

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Create SVG Artwork from Text Prompts

Designers and developers often need quick vector artwork from a written idea. This skill generates an image with Gemini, traces it, and saves an SVG file.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "create-svg-from-prompt" from https://skillstore.io/skills/0x6a77-create-svg-from-prompt.md and its manifest at https://skillstore.io/api/skills/0x6a77-create-svg-from-prompt/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/0x6a77-create-svg-from-prompt.md Signed manifest GET /api/skills/0x6a77-create-svg-from-prompt/manifest Signed lockfile GET /api/skills/0x6a77-create-svg-from-prompt/lockfile

Test it

Using "create-svg-from-prompt". Generate an SVG of a small rocket launching from a laptop.

Expected outcome:

A rocket-themed SVG asset saved with a descriptive filename for web or document use.

Using "create-svg-from-prompt". Generate an SVG of a simple onboarding checklist illustration.

Expected outcome:

An editable vector illustration showing checklist items, progress, and a clean onboarding theme.

Using "create-svg-from-prompt". Generate an SVG of a cloud database with sync arrows.

Expected outcome:

A traced SVG concept asset suitable for technical documentation or a dashboard empty state.

Security Audit

High Risk
v9 • 7/6/2026 Open versioned report

The skill performs the advertised SVG generation workflow, but it requires privileged package installation, an unpinned source build, external API calls, and access to a Gemini API key. Several Ruby backtick detections are Markdown formatting false positives, but the sudo, network, credential, and shell-pipeline risks are real.

1
Files scanned
38
Lines analyzed
9
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:13-18
Unpinned Privileged Source Build
The setup clones autotrace from GitHub, builds it, and installs it with sudo without pinning a commit or verifying integrity. A changed upstream repository could affect the host with root privileges.
The workflow directly combines git clone, make, and sudo make install. The file shows no version pin, checksum, signature check, or sandboxing.
High
SKILL.md:30SKILL.md:35
Unsanitized Prompt Interpolation In Shell Command
The workflow inserts the user image prompt into a shell command JSON payload without showing escaping or structured argument construction. Special characters in the prompt could break the command or change transmitted content.
Line 30 embeds a prompt placeholder inside shell-quoted JSON, and line 35 says to preserve the user prompt. The exact runtime substitution is agent-mediated, so confidence is high but not absolute.
Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:10-19
Ruby/shell backtick execution
```bash
The fenced block beginning on line 10 contains host package installation, cloning, building, and install commands. This is real external command execution guidance with system impact.
High
SKILL.md:29-31
Ruby/shell backtick execution
```bash
The fenced block beginning on line 29 contains a shell pipeline with curl, grep, cut, base64, and autotrace. It processes network output through local commands.
High
SKILL.md:11
sudo privilege escalation
sudo apt update
Line 11 explicitly runs sudo apt update. This requires elevated privileges and changes host package metadata.
High
SKILL.md:12
sudo privilege escalation
sudo apt install git build-essential intltool imagemagick libmagickcore-dev pstoedit libpstoedit-dev
Line 12 explicitly runs sudo apt install for multiple packages. This modifies the host system with elevated privileges.
High
SKILL.md:18
sudo privilege escalation
sudo make install
Line 18 runs sudo make install after building cloned source. Installing build output as root is a privileged system modification.
High
SKILL.md:30
Generic API/secret keys
curl -s -X POST "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image:gene
Line 30 places the Gemini API key into a curl request header. The key is required for the API call but is sensitive credential material.
High
SKILL.md:34
Generic API/secret keys
- `<GEMINI_API_KEY>`: The Gemini API key gotten from the environment variable "GEMINI_API_KEY"
Line 34 instructs the model to obtain GEMINI_API_KEY from the environment. Accessing API secrets is a real credential-handling risk even when intentional.
Medium
SKILL.md:30
Hardcoded URL
curl -s -X POST "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image:gene
Line 30 posts prompt data to the hardcoded Google Generative Language API endpoint. This is external network transmission of user content.
Low
SKILL.md:13
Hardcoded URL
git clone https://github.com/autotrace/autotrace.git
Line 13 clones source from a hardcoded GitHub URL. This is expected dependency retrieval, but it is still external network access.

Risk Factors

⚙️ External commands (10)
SKILL.md:8 SKILL.md:10-19 SKILL.md:19-29 SKILL.md:29-31 SKILL.md:31-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:11 SKILL.md:12 SKILL.md:18
🌐 Network access (2)
SKILL.md:13 SKILL.md:30
🔑 Env variables (2)
SKILL.md:30 SKILL.md:34
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/0x6a77-create-svg-from-prompt/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/0x6a77-create-svg-from-prompt/security.svg)](https://skillstore.io/skills/0x6a77-create-svg-from-prompt?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/0x6a77-create-svg-from-prompt?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/0x6a77-create-svg-from-prompt/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/0x6a77-create-svg-from-prompt.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

0x6a77. (2026). create-svg-from-prompt security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/0x6a77-create-svg-from-prompt/audits/9

BibTeX citation

@techreport{0x6a77-0x6a77-create-svg-from-prompt-2026, author = {0x6a77}, title = {create-svg-from-prompt security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/0x6a77-create-svg-from-prompt/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "create-svg-from-prompt security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "0x6a77" date-released: "2026-07-06" url: "https://skillstore.io/skills/0x6a77-create-svg-from-prompt/audits/9" identifiers: - type: other value: "skillstore:0x6a77-create-svg-from-prompt:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
85
Content
80
Community
83
Spec Compliance

What You Can Build

Prototype Interface Illustrations

Generate small SVG illustrations for product mockups, empty states, or documentation pages.

Create Lightweight Web Assets

Turn simple visual ideas into SVG files that can be edited or embedded in web projects.

Draft Visual Concepts Quickly

Produce editable vector drafts before investing time in manual illustration work.

Try These Prompts

Simple Icon 
Generate an SVG of a simple line icon showing a calendar with a check mark.
Product Illustration 
Generate an SVG of a clean dashboard illustration with charts, a task list, and a small success indicator.
Style-Controlled Scene 
Generate an SVG of a flat vector scene showing a mobile developer testing an app, using clear shapes and limited colors.
Asset With Constraints 
Generate an SVG hero illustration for a security report page, with a shield, document marks, and restrained professional colors.

Best Practices

  • Use concise prompts with clear subjects, style, and intended use.
  • Avoid sensitive or private details because prompts are sent to an external API.
  • Review and optimize the resulting SVG before production use.

Avoid

  • Do not use this skill for confidential visual concepts without approval.
  • Do not expect precise brand compliance from a generated and traced image.
  • Do not run setup commands on shared systems without reviewing them first.

Frequently Asked Questions

What does this skill create?
It creates SVG files from text prompts by generating an image and tracing it into vector form.
Does it need an API key?
Yes. The workflow expects a Gemini API key available through the GEMINI_API_KEY environment variable.
Does it work without network access?
No. It calls the Google Generative Language API to create the source image.
Can the SVG be edited later?
Yes. The output is an SVG file, but traced shapes may need cleanup in a vector editor.
Is this suitable for exact logos?
It is better for draft illustrations and simple assets than exact brand marks or production logos.
What should users review before running it?
Users should review setup commands, external API use, API key handling, and the generated SVG output.

Developer Details

Author

0x6a77

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/0x6a77/pelican-rides-a-bicycle/tree/main/.claude/skills/create-svg-from-prompt

Ref

2e36836131679643f7a49e4cfff588d67adc404b

Maintenance freshness

7/18/2026

Usage

226 downloads · 442 views

File structure

📄 SKILL.md