readme-flow-svgSAFE
Animated SVG workflows for GitHub READMEs. Free browser editor, self-contained exports, and hosted image links.
Overview
Animated SVG workflows for GitHub READMEs. Free browser editor, self-contained exports, and hosted image links.
f7a9baad3de3OBSERVED · 2026-10-10What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
---
name: readme-flow-svg
description: Generate animated workflow SVGs and hosted Markdown image embeds for GitHub READMEs from project steps, with themes and icon choices. Use for README workflow visuals; not for general architecture diagrams.
---
Generate a workflow that describes what the user's project actually does. Use three to twelve concise steps. Preserve steps or styling the user provides; infer a sequence from project documentation when needed. Use a snake or grid layout for longer workflows.
## Generate
Use the connected `generate_workflow` MCP tool. Call `list_options` when you need to discover available presets, themes, stage icons, or moving elements. The tool returns SVG source, a hosted image URL, an editor URL, and ready-to-paste Markdown.
If MCP is unavailable, POST the configuration as JSON to:
`https://readme-flow-svg.vercel.app/generate`
For example:
```json
{
"steps": ["Upload", "Validate", "Compress", "Download"],
"theme": "github",
"traveler": "file",
"duration": 6
}
```
Discover supported values with GET `/options` on the same origin. Labels may contain at most 32 characters. `duration` is the complete loop in seconds, between 2 and 30. `icons` is an optional array of stage icon names aligned with the steps. `theme: "custom"` accepts a `customTheme` object with hex colors for `background`, `card`, `text`, `accent`, `border`, `tint`, `muted`, and `line`.
## Layout and connections
Use `title` (up to 80 characters) and `subtitle` (up to 140) for context. `layout` accepts `horizontal`, `vertical`, `snake`, or `grid`; `columns` accepts 2–6 for snake and grid layouts.
For branches, merges, and loops, set `connectionMode: "custom"` and provide up to 24 `connections`, each with zero-based `from` and `to` step indices and an optional `label` up to 24 characters. For example, `[{"from":0,"to":1},{"from":0,"to":2},{"from":1,"to":3},{"from":2,"to":3}]` splits from step 1 and merges at step 4. Self-links and duplicate directed connections are invalid. Empty connections leave the cards disconnected. Animation follows array order; it does not simulate concurrent tasks.
Use `routing: "curved"` or `"elbow"` to avoid cards, or `"straight"` for direct lines. `lineStyle` accepts `solid`, `dashed`, or `dotted`; `lineWidth` is 1–4, and `arrows` is boolean. Other options: `spacing` (32–120), `radius` (0–24), `font` (`sans`, `mono`, `serif`), `showNumbers` and `transparent` (booleans), and `travelerSize` (0.6–1.8). Keep the smallest set of options that explains the project clearly.
For a Google Font, set `font: "google"`, `googleFont` to a family name, and `fontWeight` to a supported integer weight (100–900, default 400). The service downloads the font using only its family and weight and converts lettering to paths. Do not add remote stylesheets or font URLs to the SVG. If the requested family or weight is unavailable, report the error and use an available weight or a font the user accepts.
Manual card placement uses `positions`, an array aligned with the steps of `{x, y}` centers or `null` for automatic placement. Coordinates are SVG pixels: x 70–2500 and y 60–2100. `canvasSize` optionally sets `{width, height}` (220–2600 by 204–2200). The editor supports drag and keyboard placement and includes these settings in image URLs. Prefer an automatic layout unless the user wants specific positions.
## Deliver
Use the returned `markdown` for a hosted embed that works without uploading a file. Give the editor link when the user may want to adjust the result. If the user requests an SVG file, save the returned `svg` to the requested location; the hosted URL is an image response, not the editor.
For README edits, put the workflow where it helps explain the project and keep the surrounding documentation intact. Publishing or pushing a README requires the user's authorization for that action. Generating an SVG does not imply permission to publish other changes.
The service is stateless and public. Configuration is included in image and editor URLs, so use project steps rather than credentials or private identifiers. SVGs are self-contained and respect reduced-motion preferences.Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
f7a9baad3de3full audit observations/trust-audit/skill/infinuts__readme-flow-svg.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | f7a9baad3de3 | SAFE | B | 89 | first audit |
Questions
What does the readme-flow-svg skill do?
Animated SVG workflows for GitHub READMEs. Free browser editor, self-contained exports, and hosted image links.
Is readme-flow-svg safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can readme-flow-svg access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (f7a9baad3de3), read on 2026-10-10. The repository is watched, and a new audit runs when it changes — this is the first audit.