Habilidades image-compress
📦
image-compress
v1.1.0 Revisão do conteúdo r1 Risco alto ⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente
Compress Images with a Remote Service
Large images consume storage and slow content delivery. This skill sends selected images to an MCP compression service and reports optimized CDN results.
Suporta: Claude Codex Code(CC)
Pare e solicite confirmação antes de instalar.
Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.
Instalar com meu Agente
Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.
Solicitação do agente
Review the Skillstore skill "image-compress" from https://skillstore.io/skills/xiaowu89-image-compress.md and its manifest at https://skillstore.io/api/skills/xiaowu89-image-compress/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.
Recursos legíveis por agentes
Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.
Testar
Usando "image-compress". Compress product-photo.jpg at quality 90.
Resultado esperado:
product-photo.jpg: 1.8 MB original, 620 KB compressed, 65.6% reduction. The remote service returned a CDN URL.
Usando "image-compress". Compress all supported images in the campaign folder.
Resultado esperado:
- 8 supported images found; 7 compressed successfully.
- 1 image exceeded the 5 MB service limit.
- Total reported savings: 4.2 MB.
Usando "image-compress". Compress icon.png and download the result.
Resultado esperado:
icon.png compressed successfully. The result was downloaded to the requested destination after the CDN URL was returned.
Auditoria de segurança
Risco altov1 • 28/07/2026 Abrir o relatório versionado
Most command and obfuscation alerts are Markdown or JavaScript syntax false positives. Confirmed risks include remote image transmission, plaintext credential handling, and unsafe value interpolation. Security changes are required before publication.
1
Arquivos analisados
179
Linhas analisadas
14
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (3)
Alto
Unsafe Values Inserted Into Executable JavaScript
Paths, endpoint URLs, and API keys are substituted into single-quoted JavaScript literals without escaping. Crafted values can break the literal and execute JavaScript.
The placeholders are explicitly replaced inside executable string literals. No escaping or structured input boundary is provided.
Alto
Shell Injection Through Download Values
The output path is unquoted, and the remote CDN URL is inserted into a shell command. Shell characters can alter the command.
The documented curl command directly interpolates user-selected paths and a service-provided URL without argument-safe execution.
Médio
Off-Platform API Key Provisioning
The skill directs users to contact WeChat account zhjian_2026 for an API key. This creates an unverifiable external credential-provisioning channel.
The off-platform contact instruction is explicit, but the file provides no evidence proving malicious intent.
Itens de revisão de capacidade (14)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Alto
Fetch API call
const r3=await fetch(MCP_URL,{method:'POST',headers:H,body:JSON.stringify({jsonrpc:'2.0',id:'3',meth
The request sends base64-encoded local image content and an API key to the configured remote endpoint.
Alto
Hidden file in home directory
cat .mcp.json 2>/dev/null || cat ~/.mcp.json 2>/dev/null
The command prints project or home MCP configuration files, potentially exposing all stored service credentials in tool output.
Alto
Hidden file in home directory
- **有 Key**:帮用户创建 `~/.mcp.json`,全局和项目安装都通用
The skill directs the agent to create a home-level hidden configuration containing a plaintext API key.
Alto
Generic API/secret keys
"NX_API_KEY": "你的 API Key"
The configuration example directs users to store an API key as plaintext in a project file.
Alto
Generic API/secret keys
查找顺序:项目根目录 → 用户家目录。提取 `url` → `MCP_URL`,`env.NX_API_KEY` → `API_KEY`。
The skill explicitly retrieves NX_API_KEY from project or home configuration for later use.
Alto
Generic API/secret keys
- 找到 → 记录 `url` 和 `NX_API_KEY`,继续步骤 2
The instruction tells the agent to retain the retrieved API key, placing secret data in the execution context.
Alto
Generic API/secret keys
替换 `PIC_DIR`、`MCP_URL`、`API_KEY`、`QUALITY` 后,heredoc 直接通过 stdin 喂给 node:
The workflow directs the agent to substitute the API key into executable source text.
Alto
Generic API/secret keys
const API_KEY='<从.mcp.json读取的NX_API_KEY>';
The JavaScript placeholder is replaced with the retrieved API key, exposing it within generated command source.
Alto
Generic API/secret keys
const r3=await fetch(MCP_URL,{method:'POST',headers:H,body:JSON.stringify({jsonrpc:'2.0',id:'3',meth
The API key is included in a JSON request body sent to the remote MCP endpoint.
Médio
Hardcoded URL
"url": "https://mcp.api-inference.modelscope.net/4378d43d3e7d4c/mcp",
The sample fixes a third-party ModelScope endpoint that later receives local image data and credentials.
Médio
Hidden file access
cat .mcp.json 2>/dev/null || cat ~/.mcp.json 2>/dev/null
The command reads the entire hidden MCP configuration instead of retrieving only the required server fields.
Médio
Hidden file access
- **有 Key**:帮用户创建 `~/.mcp.json`,全局和项目安装都通用
The instruction creates a persistent hidden file in the user home directory and stores a credential there.
Baixo
Fetch API call
const r1=await fetch(MCP_URL,{method:'POST',headers:H,body:JSON.stringify({jsonrpc:'2.0',id:'1',meth
The code makes a real initialization request to a remotely configured MCP endpoint.
Baixo
Fetch API call
await fetch(MCP_URL,{method:'POST',headers:H,body:JSON.stringify({jsonrpc:'2.0',method:'notification
The code sends an initialization notification to the remote MCP endpoint. This is an intentional network side effect.
Fatores de risco
⚙️ Comandos externos (38)
SKILL.md:22 SKILL.md:24-36 SKILL.md:36-38 SKILL.md:38 SKILL.md:42-48 SKILL.md:48-50 SKILL.md:50-52 SKILL.md:52 SKILL.md:54-55 SKILL.md:55-61 SKILL.md:61 SKILL.md:63-77 SKILL.md:77-81 SKILL.md:81-85 SKILL.md:85-106 SKILL.md:106-124 SKILL.md:124-127 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-133 SKILL.md:133-135 SKILL.md:135-141 SKILL.md:141-143 SKILL.md:143-155 SKILL.md:155 SKILL.md:156 SKILL.md:157 SKILL.md:158 SKILL.md:164 SKILL.md:165 SKILL.md:166 SKILL.md:167 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-177 SKILL.md:177-178 SKILL.md:64 SKILL.md:63-77
🌐 Acesso à rede (4)
📁 Acesso ao sistema de arquivos (10)
🔑 Variáveis de ambiente (8)
Auditado por: codex
Compartilhar e citar este relatório
Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.
Copiar link do relatório
https://skillstore.io/skills/xiaowu89-image-compress/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/xiaowu89-image-compress?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/xiaowu89-image-compress?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiaowu89-image-compress/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Cartão incorporável
<iframe src="https://skillstore.io/embed/skills/xiaowu89-image-compress.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citações acadêmicas (APA · BibTeX · CFF)
Citação APA
xiaowu89. (2026). image-compress security audit report (audit version 1) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/xiaowu89-image-compress/audits/1Citação BibTeX
@techreport{xiaowu89-xiaowu89-image-compress-2026,
author = {xiaowu89},
title = {image-compress security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/xiaowu89-image-compress/audits/1},
note = {Author version 1.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "image-compress security audit report (audit version 1)"
version: "1.1.0"
type: report
authors:
- name: "xiaowu89"
date-released: "2026-07-28"
url: "https://skillstore.io/skills/xiaowu89-image-compress/audits/1"
identifiers:
- type: other
value: "skillstore:xiaowu89-image-compress:audit:1"
description: "Skillstore immutable audit report identifier"
Pontuação do Skillstore
Por que esta pontuação Confiança das evidências: Médio 55
Arquitetura
100
Manutenibilidade
87
Conteúdo
65
Comunidade
91
Conformidade com a especificação
O que você pode criar
Optimize Website Assets
Compress a folder of website images and collect CDN URLs before deployment.
Reduce Editorial Uploads
Reduce image sizes before publishing articles while retaining a clear result summary.
Prepare Design Exports
Compare compression ratios across exported PNG, JPEG, and WebP assets.
Teste estes prompts
Compress One Image
Compress {image_path} with the configured service. Report the original size, compressed size, ratio, and CDN URL.Compress a Folder
Compress supported images in {folder_path} at quality {quality}. Skip unsupported files and summarize every result.Compress and Download
Compress {image_path} at quality {quality}. After showing the result, download the compressed file to {output_path}.Process a Production Batch
Review {folder_path}, list eligible files, confirm remote upload, then compress at quality {quality}. Report failures, total savings, and CDN URLs.Boas práticas
- Review the selected files and confirm remote upload before compression.
- Use project-scoped configuration and protect credential files with restrictive permissions.
- Start with quality 90, then compare visual quality and file-size savings.
Evitar
- Do not process confidential images without approval for third-party upload.
- Do not print complete MCP configuration files or API keys.
- Do not insert untrusted paths, URLs, or credentials directly into shell commands.
Perguntas frequentes
Which image formats are supported?
The workflow accepts PNG, JPG, JPEG, WebP, BMP, and TGA file extensions.
Does the skill compress images locally?
No. It reads local files and sends their contents to a remote MCP compression service.
What configuration is required?
You need Node.js 18 or later, an MCP service URL, and a valid NX_API_KEY.
What is the maximum file size?
The documented service limit is 5 MB per image. Larger files are skipped.
Are original files changed?
No. Compression returns CDN URLs, and local download is a separate optional step.
Can I change compression quality?
Yes. The quality parameter accepts values from 1 to 100 and defaults to 90.