The Agent Skills Directory

[COMMAND_EXECUTION]: The script executes external image processing binaries including sips, cwebp, and convert. These commands are executed using child_process.spawn with arguments passed as an array, which prevents command injection vulnerabilities by ensuring user-provided filenames are not executed as shell code.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx and dynamic imports for the well-known sharp library. This may involve downloading the package or its pre-compiled binaries from official registries, which is standard behavior for Node.js image processing tools.
[PROMPT_INJECTION]: The skill ingests file paths and directory names from the agent's environment. It mitigates risks by validating input parameters (such as quality and format) and using secure path resolution methods to manage file system access during the compression process.

baoyu-compress-image