compresso
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download binaries (AppImage, DMG, MSI) and source code from the "codeforreal1/compressO" repository on GitHub.
- [REMOTE_CODE_EXECUTION]: The installation instructions include fetching the skill via "npx" from a third-party GitHub repository ("akillness/jeo-skills") and installing software through a custom Homebrew tap ("codeforreal1/tap/compresso").
- [COMMAND_EXECUTION]: The documentation encourages the execution of external binaries after modifying permissions ("chmod +x") and building the application from source using "pnpm install", which downloads and executes third-party Node.js dependencies.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill is designed to process external video and image files and their associated metadata (SKILL.md).
- Boundary markers: No explicit instructions are present to ensure that the agent ignores instructions that could be embedded in the processed files' metadata or subtitles.
- Capability inventory: The skill leverages powerful system tools such as FFmpeg and Tauri (SKILL.md).
- Sanitization: There is no mention of sanitizing or validating the content or metadata of the files before they are processed by the underlying tools.
Audit Metadata