vectorize-91f26b — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vectorize-91f26b (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
/vectorize (hosted, highest quality)Input: any raster. Output: clean SVG, typically 20–100 paths for a mark, 200–500 for an illustration. Commercial tier only.
const svg = await recraft.vectorize({ image: pngBuffer });vtracer (local, multi-color polygon)npm install vtracer for the Node wrapper.polygon (recommended for logos), spline (smoother curves), pixel (blocky).pipeline:
raster 1024²
→ BiRefNet matte (alpha the background)
→ K-means LAB 6-color palette
→ vtracer --mode polygon --filter-speckle 4 --color-precision 6
→ SVGO (conservative preset)potrace (local, 1-bit)<g>s.pipeline:
raster 1024²
→ BiRefNet matte
→ per-color mask (binary threshold per palette entry)
→ potrace per mask → <g> wrapper
→ combine into single SVG
→ SVGO| Use case | Path |
|---|---|
| Budget available, one-shot quality | Recraft vectorize |
| Multi-color logo, local | vtracer (polygon mode) |
| Single-color icon pack | potrace |
| Photorealistic illustration → vector | don't — keep as PNG/WebP. Vectorization of photoreal is lossy noise. |
After vectorization, count <path> elements:
Conservative preset — preserve: viewBox, IDs, classes. Strip: metadata, editor comments, hidden elements.
{
multipass: true,
plugins: [
{ name: 'preset-default', params: {
overrides: { removeViewBox: false, cleanupIds: { minify: false } } } },
'removeDimensions', // prefer viewBox-only
'sortAttrs',
'removeScriptElement' // security
]
}Never enable convertPathData with default floatPrecision — it collapses small strokes.
@resvg/resvg-js without errors.<path> count ≤ 200 for logos, ≤ 500 for illustrations.<image> tags (sneaking raster into SVG).<script> tags.vector/
├── mark.svg # primary vectorization
├── mark.svg.orig # pre-SVGO original (for debugging)
└── meta.json # paths_count, colors_used, svgo_savings_bytes~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.