svg-report-lint

name

svg-report-lint

description

Lint a standalone SVG file for geometry soundness, legibility, and security before committing to a report or embedding in Power BI/Tableau. Checks viewBox presence and aspect ratio, minimum text font-size, and the security floor: no <script>, no on* handlers, no <foreignObject>, no remote href/use. Gate 103. Complements declarative-visualization (Vega-Lite/JSON spec lint, Gate 101) and pbir-layout-engine (coordinate arithmetic). NOT for Vega-Lite JSON specs (use declarative-visualization) or coordinate layout arithmetic (pbir-layout-engine).

Skill: svg-report-lint

What this is

A stdlib-only, exit-coded SVG linter for standalone SVG files used in reports, dashboards, and embedded graphics. It checks for geometry soundness (viewBox, aspect ratio), legibility (minimum font-size), and the security floor (no script injection vectors). It is the SVG analog of pbir-layout-engine (geometry) and declarative-visualization/lint.py (spec security).

The conceptual canon and surface-delivery map live in ../../knowledge/declarative-visualization.md. Design-first workflow guidance lives in ../../knowledge/design-first-report-workflow.md.

Usage

python3 plugins/ravenclaude-core/skills/svg-report-lint/lint.py <file.svg>
python3 plugins/ravenclaude-core/skills/svg-report-lint/lint.py <file.svg> --min-fontsize 10
python3 plugins/ravenclaude-core/skills/svg-report-lint/lint.py --list-checks

Exit 0 = clean. Exit 1 = violation (reject the SVG and fix). Exit 2 = I/O or path error.

Checks (all → exit 1)

ID	Check	What it catches
viewbox-present	root <svg> has a viewBox attribute	SVGs without viewBox scale unpredictably on different screen sizes
viewbox-sane-aspect	viewBox width/height ratio between 0.05 and 20	Extreme aspect ratios (e.g. 1000×1) indicate a broken canvas definition
text-min-fontsize	<text> / <tspan> font-size ≥ 8px (configurable)	Text below the threshold is illegible at report scale
no-script	No <script> element	Script injection in SVG context
no-inline-handlers	No on* event attributes (onclick, onload, etc.)	Inline JS execution
no-foreign-object	No <foreignObject> element	HTML injection / XSS-escalation
no-remote-href	No remote or javascript: href/xlink:href	Network fetch + potential JS execution
no-remote-use	No <use> referencing a remote URL	External SVG inclusion / data exfiltration

The security checks (no-script, no-inline-handlers, no-foreign-object, no-remote-href, no-remote-use) are default-fail with no --lenient option. A script-carrying SVG is never acceptable in a committed report.

Relationship to the viz spine

Concern	Right tool
Vega-Lite / Deneb / Vega spec (JSON) security + quality	declarative-visualization/lint.py (Gate 101)
Standalone SVG geometry + security	This skill (Gate 103)
PBIR coordinate layout arithmetic	pbir-layout-engine/lint.py (Gate 92)
Render→see→critique loop	visual-feedback-loop/driver.py (Gate 100)
Spec review + design-honesty judgment	viz-spec-reviewer agent

For SVG-in-DAX (Power BI Image visual)

DAX-constructed SVG strings carry the same injection surface as a file-based SVG. To lint an SVG-in-DAX badge:

1. Extract the SVG string from the DAX measure (everything after "data:image/svg+xml;utf8,").
2. URL-decode (%20 → space, %3C → <, etc.) if the string uses URL encoding.
3. Save to a temporary .svg file.
4. Run lint.py on that file.

For the complete SVG-in-DAX pattern and DAX string construction approach, see plugins/power-platform/knowledge/power-bi-custom-visuals-toolkit.md §SVG-in-DAX.

Proven by Gate 103

scripts/audit-gates.sh Gate 103 asserts bidirectionally:

• A clean badge SVG passes (exit 0).
• Each violation class exits non-zero individually.
• A mutant linter that hardcodes exit 0 lets known-bad SVGs through (teeth).

Purity contract

• Stdlib-only — xml.etree.ElementTree, re, os, sys. No subprocess, no urllib, no socket, no eval, no exec.
• No network — the linter parses XML as inert data; it never fetches any URL.
• Path safety — rejects .. in argv, rejects paths outside the repo root.
• Exit-coded — deterministic exit 0/1/2; no partial-pass.