skills/stianlars1/tinify-claude-plugin/tinify-images/Socket

tinify-images

Warn

Audited by Socket on Jul 24, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The core purpose is coherent for an image-optimization skill and the main API domain appears same-org, but the recommended `npx @tinify-dev/client` path is not independently verifiable and may receive `TINIFY_API_KEY`, creating a high supply-chain and credential-forwarding risk. Server-side image upload is expected but means user images leave the machine.

Confidence: 86%Severity: 82%

Audit Metadata

Analyzed At

Jul 24, 2026, 12:43 PM

Package URL

pkg:socket/skills-sh/Stianlars1%2Ftinify-claude-plugin%2Ftinify-images%2F@13495f12ac6b3bb16b34fbe5fb8fd47ef72c2414451465b4e8991b0e52b134cb