tinypng
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and run the@useclawlink/clipackage from the NPM registry. This is the official tool provided by the vendor (ClawLink) for interacting with their service. - [COMMAND_EXECUTION]: The skill relies on shell commands to perform setup and execution tasks. It uses
npx @useclawlink/cli loginfor authentication and variousruncommands to perform TinyPNG operations like image shrinking and transformation. - [PROMPT_INJECTION]: The skill processes data retrieved from the TinyPNG API (e.g., compression counts, image IDs), which constitutes an indirect prompt injection surface. The instructions include a safeguard requiring the agent to confirm with the user before performing any write operations.
- [DATA_EXPOSURE]: The documentation identifies that credentials for the service are stored locally at
~/.clawlink/credentials.json. The skill describes this as part of the standard setup process and does not include instructions to exfiltrate or unsafely access this file.
Audit Metadata