baoyu-compress-image
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/main.tsinvokes system-level image processing utilities includingsips,cwebp, and ImageMagick (convert) via subprocesses. It passes user-provided file paths as arguments to these commands. - [DYNAMIC_EXECUTION]: The script uses a dynamic
import()call to load thesharplibrary during image processing tasks, which is a standard pattern for handling optional dependencies or late-loading libraries in Node.js. - [INDIRECT_PROMPT_INJECTION]: The skill accepts file and directory paths as input arguments, creating an ingestion surface for potentially untrusted filesystem data.
- Ingestion points:
opts.inputargument inscripts/main.tswhich is resolved to an absolute path. - Boundary markers: None present as the skill operates as a CLI tool rather than a prompt-generating agent.
- Capability inventory: The skill uses
child_process.spawnfor command execution andfsmodules forunlinkSync(deleting original files) andrenameSync(moving compressed output). - Sanitization: Input paths are resolved using
path.resolve, and command arguments are passed as a list tospawnwhich mitigates shell injection risks.
Audit Metadata