baoyu-compress-image

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script executes external system utilities (sips, cwebp, and ImageMagick's convert) to process images. These commands are invoked using child_process.spawn with argument arrays, which is a secure method that prevents shell-based command injection.
  • [DYNAMIC_EXECUTION]: The script uses dynamic import() to load the 'sharp' image processing library at runtime if other system-level compressors are not detected. This is a standard pattern for optional dependencies.
  • [EXTERNAL_DOWNLOADS]: The skill's instructions suggest using npx -y bun if the Bun runtime is not locally available. This invokes a download of the official 'bun' package from the npm registry, a well-known service.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads from and writes to the file system to perform its primary purpose of image compression. It implements file management logic to resolve paths, create temporary files, and optionally back up original files by renaming them.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 03:19 PM
Security Audit — agent-trust-hub — baoyu-compress-image