optimize-images
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- COMMAND_EXECUTION (HIGH): The skill contains a shell injection vulnerability in the image discovery step.\n
- Evidence: The variable
${ARGUMENTS}is used without quoting or sanitization in the commandfind ${ARGUMENTS:-./public/images} .... An attacker could provide a directory path containing shell metacharacters (e.g.,; rm -rf /) to execute arbitrary commands on the host system.\n- EXTERNAL_DOWNLOADS (MEDIUM): The skill performs unverified software installation during execution.\n - Evidence: The command
pnpm add -D sharp-clidownloads and installs a package from the public npm registry without version pinning or hash verification, introducing a supply chain risk.
Recommendations
- AI detected serious security threats
Audit Metadata