baoyu-compress-image
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script executes local image processing utilities including
sips,cwebp, and ImageMagick'sconvert. It also uses thewhichcommand to detect tool availability. All commands are executed using the securespawnarray syntax which prevents shell injection. - [EXTERNAL_DOWNLOADS]: The skill instructions suggest using
npxto runbunif it is not present, which involves downloading the bun package. Additionally, the script dynamically imports thesharpimage processing library, which is a common and well-known Node.js dependency.
Audit Metadata