v6.3.1

Patch release. Upgrading is recommended for anyone who opens the live preview (svg_editor/server.py) on projects that contain SVG from third-party sources.

Security

Two issues were reported privately by an external researcher and fixed in 514596e. Both require a malicious SVG to already be inside a project directory (for example from a third-party template pack, or a poisoned source document converted by the pipeline). Neither allows reading files outside the project; both servers keep binding to 127.0.0.1 only.

• Live preview sanitizer bypass (mXSS). sanitizeSvg() in the preview page compared element and attribute names case-sensitively on an XML parse, then inserted the result through innerHTML, which lowercases names. Uppercase ONERROR=, <SCRIPT>, and XLINK:HREF="javascript:" therefore survived the filter. Comparisons are now case-insensitive, elements outside the SVG/XLink namespaces are dropped, vbscript: is rejected alongside javascript: and data:, and a malformed SVG now shows an error instead of injecting the parser error document. The preview page also gains a Content-Security-Policy restricting scripts to same-origin files.
• Icon placeholder attribute injection. embed_icons.py interpolated fill, stroke, stroke-width, and transform from <use data-icon> placeholders into generated markup without escaping. A single-quoted value containing a bare " could inject a sibling attribute that the CLI then wrote to disk. The four attributes are now validated against strict grammars and every interpolated value is escaped. Legal values, including the matrix() transforms written back by the live editor, are unchanged; a regression run over an existing 50-page project produced byte-identical output.

Other changes since v6.3.0

• Templates: Z-CARE Rescue brand and duty-manual style.
• Video: keep the space between merged subtitle clauses (#283, thanks @MaxFreedomPollard).
• Scripts: slice_images.py keeps opaque key-hue foreground intact during pure-key despill.
• README: star history chart restored, trending badge added.

Install

The ppt-master-skill-v6.3.1.zip asset contains only skills/ppt-master/ for agents that load the skill directory directly.