Skills
skills/jst-well-dan/skill-box/baoyu-compress-image/Gen Agent Trust Hub

baoyu-compress-image

Pass

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • Command Execution (SAFE): The implementation in scripts/main.ts uses child_process.spawn with argument arrays to invoke sips, cwebp, and convert. This approach is safe against shell injection vulnerabilities.
  • Indirect Prompt Injection (LOW): The skill handles external image files and has the authority to delete files, creating a minor attack surface. 1. Ingestion points: Processes user-provided image files in scripts/main.ts. 2. Boundary markers: None identified in the provided instructions. 3. Capability inventory: Uses unlinkSync, renameSync, and spawn in scripts/main.ts. 4. Sanitization: Filters input through a hardcoded whitelist of image extensions.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 17, 2026, 06:21 PM