image-optimization-weapon
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No attempts to override agent behavior, bypass safety filters, or extract system prompts were detected. The instructions are focused entirely on technical implementation of image optimization.
- [DATA_EXFILTRATION]: The skill does not contain commands that access sensitive system files (like credentials or SSH keys). It provides security guidance for the
next/imagecomponent to prevent Server-Side Request Forgery (SSRF) by recommending specific hostname patterns. - [EXTERNAL_DOWNLOADS]: The skill recommends several well-known and reputable Node.js packages for image processing, including Sharp and Plaiceholder. These are standard tools in the web development ecosystem.
- [COMMAND_EXECUTION]: While the skill provides example scripts for batch image conversion using the Sharp Node.js API and Squoosh CLI, these scripts are legitimate developer tools. They do not exhibit any signs of command injection or malicious background execution.
- [STATIC_ANALYSIS]: Files were scanned for obfuscation techniques such as zero-width characters, homoglyphs, and multi-layer Base64 encoding. No such techniques were found. Base64 strings detected in the guides are used for standard image data URIs (LQIP), which is an expected behavior for this domain.
Audit Metadata