Image Compressor

Compress JPG, PNG, WebP, and GIF images to reduce file size significantly while preserving visual quality with bulk compression support.

Security Scan

The skill claims to compress images and even lists an API key and a per-call price, but the code is a stub that does no compression and does not use the included secret — the pieces are inconsistent and require clarification before trust.

Purpose & Capability

The manifest and SKILL.md claim full-featured image compression (bulk support, pricing, API key). The included handler.py contains only a URL regex and returns a demo message saying 'Integrate with TinyPNG API for actual compression' — it does not perform compression, call any external API, or implement payment. This is a clear mismatch between claimed capability and the actual code.

Instruction Scope

SKILL.md provides usage examples, a hardcoded API key string, and a per-call price, but does not give concrete runtime instructions for handling uploads, where compressed images will be hosted, or how payments are processed. The instructions therefore give the agent broad, unclear authority (e.g., a secret and a price) without corresponding code to justify or constrain those actions.

Install Mechanism

No install spec is present and the skill is instruction-plus-a-small-handler only. Nothing is downloaded or written to disk by an installer; this is low-risk in itself.

Credentials

The skill declares no required environment variables but SKILL.md embeds an API key-like token (sk_...) in plaintext. That token is not used by handler.py. Hardcoded credentials in documentation/files are a red flag (possible secret leakage, placeholder token, or misconfiguration). The presence of an unexplained payment price combined with an embedded secret is disproportionate and suspicious.

Persistence & Privilege

The skill does not request always:true and has no special persistence or system-wide configuration changes. Autonomous invocation is allowed by default but not excessive here by itself.

Scan Findings in Context

[hardcoded_api_key_in_SKILL.md] unexpected: SKILL.md contains an API key-like token (sk_93c5ff38...) and a per-call price. The key is not declared in requires.env and is not used by handler.py; this could be a leaked secret, a placeholder, or an attempt to hardcode credentials into the skill.

[unused_requests_import_in_handler.py] expected: handler.py imports the 'requests' library but never uses it. This suggests the author intended to make network calls (e.g., to a compression API) but did not implement them. The import itself is not harmful but reinforces that the current code is a stub.

What to consider before installing

Do not install or enable this skill for production use until the author clarifies a few things: (1) confirm whether the API key in SKILL.md is a real credential and who controls it — if it's yours, rotate it; if it's someone else's, do not use it; (2) require a real implementation for compression (or explicit instructions that the agent will call a documented external API) and details about where compressed files are hosted; (3) ask how payments are handled and who receives the 0.001 USDT per call; (4) insist that credentials be supplied via declared environment variables (requires.env) rather than hardcoded in SKILL.md; and (5) if you still evaluate the skill, run it in a sandboxed environment and inspect network traffic to ensure no unexpected exfiltration occurs.

Compress images to reduce file size while maintaining quality.

Features

• Support JPG, PNG, WebP, GIF
• Reduce file size significantly
• Maintain visual quality
• Bulk compression support

Price

• 0.001 USDT per compression

Usage

"Compress this image https://example.com/photo.jpg"
"Reduce image size"
"Optimize this PNG"

Example Response

{
  "original_url": "https://example.com/photo.jpg",
  "original_size": "2.5MB",
  "compressed_size": "500KB",
  "reduction": "80%",
  "compressed_url": "https://cdn.example.com/optimized.jpg"
}

Integration

• API Key: sk_93c5ff38cc3e6112623d361fffcc5d1eb1b5844eac9c40043b57c0e08f91430e
• Price: 0.001 USDT per call