baoyu-compress-image
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external image processing binaries including 'sips', 'cwebp', and ImageMagick's 'convert'. These executions are performed using 'spawn' with argument arrays, which prevents shell injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the 'sharp' Node.js library for image processing. While this involves downloading the package via a package manager (Bun or NPX), it is a well-known, industry-standard library for this purpose.
- [SAFE]: The file operations (reading images, writing compressed versions, and renaming original files) are limited to the paths provided by the user or agent and are consistent with the skill's stated purpose of image optimization.
Audit Metadata