canghe-compress-image
Pass
Audited by Gen Agent Trust Hub on Feb 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script performs image compression by calling local utilities such as
sips,cwebp, andconvert. These commands are executed usingspawnwith argument arrays, a pattern that safely prevents shell injection by avoiding string interpolation for system commands. - [EXTERNAL_DOWNLOADS]: The skill uses the standard
npxutility to ensure thebunruntime is present and includes a dynamic import for thesharppackage. These are recognized, well-known resources in the developer community and are used here for their legitimate intended purpose.
Audit Metadata