svg-export — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited svg-export (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You finalize an SVG that's already been rendered and visually verified. You're the last step before the file leaves the repo. Your job: make it small, accessible, and well-named.
$ARGUMENTS[0] is the preset slug (must exist in output/). $ARGUMENTS[1..N] may include --out=<path> to copy the final file somewhere outside output/.
If no slug, return:
usage: /svg-export <preset-slug> [--out=<path>]If output/<slug>.svg doesn't exist, ask the caller to run /svg-animate (or node lib/render-cli.js <slug>) first.
Read output/<slug>.svg. Sanity-check:
<svg opening tag and </svg> closing tag.viewBox attribute (otherwise scaling is broken).<title> element (presets emit it via composeSVG's title opt).If missing, fall back to the slug. Log a warning — presets should set title and desc explicitly.
If structural checks fail, return:
EXPORT FAILED: <reason> Source: output/<slug>.svg Re-render via/svg-animateornode lib/render-cli.js <slug>.
The repo ships an animation-safe svgo.config.mjs at its root, which SVGO picks up automatically. Just point at input + output:
npx svgo -i output/<slug>.svg -o output/<slug>.min.svgDO NOT pass --enable/--disable (those are SVGO v2; this repo runs v3, where they're config-only) and DO NOT run stock preset-default. Stock SVGO is built for static icons and silently breaks animations: it collapses the group nesting that carries animation transforms (relocating transform-box: fill-box origins — e.g. a blink's eyes jump to the corner), minifies <style> (dropping @keyframes), and converts shape elements that are animation targets. The repo config disables exactly those plugins while still compressing path data. See docs/embedding-animated-svg.md.
Capture before/after sizes. Typical savings: 35–40% on an animated preset. If savings are < 5%, the file is already small — that's fine, not a problem.
Always re-verify the minified file animates (Step 3) — a size win that broke the motion is a regression, not an optimization.
Parse check — the file must contain <svg and </svg> and be non-empty. For an animated source, ALSO confirm the motion survived:
<style> block and every @keyframes still present (grep count matchesthe source). A 0 here means SVGO dropped the animation.
transform-box, it's still there.<img> (see svg-verify's <img>step) and confirm it still moves — not just that it parses.
If any check fails, abort and keep the unminified version as authoritative:
WARNING: SVGO altered the animation (e.g. @keyframes dropped / blink detached).
Keeping output/<slug>.svg as final. Check svgo.config.mjs is being applied.If --out=<path> was passed:
.svg, copy output/<slug>.min.svg there.<dir>/<slug>.svg (NOT .min.svg— users want a clean filename at the destination).
--force).EXPORTED: <slug>
Source: output/<slug>.svg (<bytes> bytes)
Minified: output/<slug>.min.svg (<bytes> bytes, <pct>% saved)
Destination: <path or "stayed in output/">
Accessibility: title="..." desc="..."
ViewBox: "<viewBox>"Keep it under 8 lines. The caller will share this with the user.
viewBox, <title>, or <desc>. They're tiny and criticalfor accessibility / responsive scaling. SVGO's default removeViewBox preset would strip viewBox; we disable it.
--force flag.Users have lost work to that.
structural check first.
--out= when the user asked. The whole pointof this skill is shipping the file to where they want it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.