baoyu-compress-image

Pass

Audited by Gen Agent Trust Hub on Mar 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script executes system commands like sips, cwebp, and convert to process images. These are called using child_process.spawn with arguments passed as an array, which is a secure implementation that prevents shell-based command injection.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx -y bun to run the compression script. npx is a standard utility that may fetch the Bun runtime from the official npm registry, which is a trusted and well-known service.
  • [COMMAND_EXECUTION]: The skill performs a dynamic import of the sharp library. This is a standard method for loading well-known, reputable image processing libraries and does not involve untrusted remote sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 1, 2026, 01:05 AM