Security audit
Security checks for vulnerabilities and agentic risk
This Markdown-only skill provides image SEO guidance and file-optimization commands that match its stated purpose, with some safety caveats around in-place metadata edits.
Before installing, understand that this skill may guide an agent to modify image files and metadata. Use it on explicit target folders, review generated commands before running them, avoid broad wildcards unless intended, and keep backups when using in-place metadata writes.
The skill provides optimization and metadata-writing workflows that modify files, but does not prominently warn users that these actions can overwrite originals, alter evidence/provenance metadata, or cause irreversible changes if run on the wrong path. In an agent setting, omission of such safeguards increases the risk of destructive file operations being executed with user trust.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
metadata, compresses, and generates responsive variants.
**Tools used (in order of preference):**
- `exiftool` -- EXIF/IPTC/XMP read/write (install: `sudo apt install libimage-exiftool-perl`)
- `cwebp` -- WebP conversion (install: `sudo apt install webp`)
- ImageMagick `convert` -- Format conversion, resizing (pre-installed on most systems)
- FFmpeg -- Fallback for format conversion (pre-installed)
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
metadata, compresses, and generates responsive variants.
**Tools used (in order of preference):**
- `exiftool` -- EXIF/IPTC/XMP read/write (install: `sudo apt install libimage-exiftool-perl`)
- `cwebp` -- WebP conversion (install: `sudo apt install webp`)
- ImageMagick `convert` -- Format conversion, resizing (pre-installed on most systems)
- FFmpeg -- Fallback for format conversion (pre-installed)
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
metadata, compresses, and generates responsive variants.
**Tools used (in order of preference):**
- `exiftool` -- EXIF/IPTC/XMP read/write (install: `sudo apt install libimage-exiftool-perl`)
- `cwebp` -- WebP conversion (install: `sudo apt install webp`)
- ImageMagick `convert` -- Format conversion, resizing (pre-installed on most systems)
- FFmpeg -- Fallback for format conversion (pre-installed)
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
metadata, compresses, and generates responsive variants.
**Tools used (in order of preference):**
- `exiftool` -- EXIF/IPTC/XMP read/write (install: `sudo apt install libimage-exiftool-perl`)
- `cwebp` -- WebP conversion (install: `sudo apt install webp`)
- ImageMagick `convert` -- Format conversion, resizing (pre-installed on most systems)
- FFmpeg -- Fallback for format conversion (pre-installed)
The batch exiftool -overwrite_original example performs in-place writes across multiple files without an explicit warning, creating a realistic risk of unintended bulk modification or metadata corruption. In a skill intended for automation, such a pattern is more dangerous because an agent may apply it broadly without the user appreciating that originals are destroyed.
Lines L461-L463 state that the iptc tool writes an XMP sidecar next to the image and requires a later merge step to embed metadata. However, the same skill documentation elsewhere presents /seo images optimize and seogeo iptc inject as directly injecting IPTC/XMP metadata into the image file itself, including examples that imply immediate modification of the target image. This is an active contradiction in the skill's stated behavior.
No suspicious patterns detected.