mcollina/snipgrapher
Configures and uses snipgrapher to generate polished code snippet images, including syntax-highlighted PNGs, SVGs, and WebP exports with custom themes, profiles, and styling options. Use when the user wants to create code screenshots, turn code into shareable images, generate pretty code snippets for docs or social posts, produce syntax-highlighted images from source files, or explicitly mentions snipgrapher. Supports single-file renders, batch jobs, watch mode, and reusable named profiles via the snipgrapher CLI or npx.
85
90%
Does it follow best practices?
Impact
79%
1.38xAverage score across 5 eval scenarios
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill invokes the snipgrapher CLI at runtime via npx (e.g., `npx --yes snipgrapher ...`), which fetches and executes code from the npm registry (e.g., https://www.npmjs.com/package/snipgrapher), so it relies on remote code execution at runtime.
Where we found it
snipgrapher
dependency · 4 sites
The skill instructs the agent to invoke the snipgrapher CLI via npx at runtime (e.g., `npx snipgrapher render`, `npx snipgrapher init`), which fetches and executes the snipgrapher package from the npm registry.
SKILL.md
21
npx snipgrapher render file.ts -o output.png
SKILL.md
27
npx snipgrapher init # creates snipgrapher.config.json
SKILL.md
28
npx snipgrapher render file.ts --profile default -o output.png
SKILL.md
58
- **Profile not found**: run `npx snipgrapher init` to regenerate `snipgrapher.config.json` if the config file is missing or malformed
- Audited
- Security analysis