tinypng-compress
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script to coordinate image compression. File paths provided as arguments are properly quoted (e.g., "$input") to prevent shell injection attacks.\n- [EXTERNAL_DOWNLOADS]: The script communicates with the well-known TinyPNG API (https://api.tinify.com) to upload files and download compressed results. This is expected behavior for a compression tool.\n- [CREDENTIALS_UNSAFE]: Authentication is managed through the TINIFY_API_KEY environment variable. This follows security best practices for secret management by avoiding hardcoded credentials and instructing the agent not to log the key.\n- [DYNAMIC_EXECUTION]: Python 3 is used to parse JSON data from API responses and calculate file size savings. The Python code is passed via a static heredoc string, ensuring that user-controlled data is treated strictly as data (arguments or stdin) rather than executable code.
Audit Metadata