zipic
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to invoke the
zipicCLI tool to perform image compression, conversion, and optimization tasks (e.g.,zipic compress --json ...). It also uses local shell and PowerShell scripts (scripts/detect.sh,scripts/detect.ps1) to verify the execution environment and locate the application binaries. \n- [EXTERNAL_DOWNLOADS]: The instructions reference the official Zipic website (https://zipic.app) for application downloads and troubleshooting resources. It also mentions using standard package managers like Homebrew on macOS for installation. \n- [INDIRECT_PROMPT_INJECTION]: The skill features a documentation retrieval mechanism where it encourages the agent to fetch live markdown content from the vendor's official domains (docs.zipic.app,zipic.app/llms.txt) to answer user queries regarding pricing, features, and troubleshooting. \n - Ingestion points: External documentation fetched from
https://docs.zipic.app/andhttps://zipic.app/llms.txt(documented inreference/resources.md).\n - Boundary markers: None explicitly defined for the fetched content.\n
- Capability inventory: Includes execution of the local
zipicCLI, shell/PowerShell scripts for environment detection, and file system writes for compressed images.\n - Sanitization: No specific sanitization methods are described for the fetched documentation content. \n- [DYNAMIC_EXECUTION]: The skill provides a pre-defined PowerShell script block used to bridge WSL environments to the native Windows application by executing commands through the
powershell.exeinterop layer.
Audit Metadata