baoyu-compress-image

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script executes local image processing utilities including sips, cwebp, and ImageMagick's convert. It also uses the which command to detect tool availability. All commands are executed using the secure spawn array syntax which prevents shell injection.
  • [EXTERNAL_DOWNLOADS]: The skill instructions suggest using npx to run bun if it is not present, which involves downloading the bun package. Additionally, the script dynamically imports the sharp image processing library, which is a common and well-known Node.js dependency.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 08:18 AM
Security Audit — agent-trust-hub — baoyu-compress-image