baoyu-compress-image
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script executes external system utilities (sips, cwebp, and ImageMagick's convert) to process images. These commands are invoked using
child_process.spawnwith argument arrays, which is a secure method that prevents shell-based command injection. - [DYNAMIC_EXECUTION]: The script uses dynamic
import()to load the 'sharp' image processing library at runtime if other system-level compressors are not detected. This is a standard pattern for optional dependencies. - [EXTERNAL_DOWNLOADS]: The skill's instructions suggest using
npx -y bunif the Bun runtime is not locally available. This invokes a download of the official 'bun' package from the npm registry, a well-known service. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads from and writes to the file system to perform its primary purpose of image compression. It implements file management logic to resolve paths, create temporary files, and optionally back up original files by renaming them.
Audit Metadata