canghe-compress-image

Pass

Audited by Gen Agent Trust Hub on Feb 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script performs image compression by calling local utilities such as sips, cwebp, and convert. These commands are executed using spawn with argument arrays, a pattern that safely prevents shell injection by avoiding string interpolation for system commands.
  • [EXTERNAL_DOWNLOADS]: The skill uses the standard npx utility to ensure the bun runtime is present and includes a dynamic import for the sharp package. These are recognized, well-known resources in the developer community and are used here for their legitimate intended purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 24, 2026, 11:24 AM