Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Baoyu Compress Image

v1.103.2

Compresses images to WebP (default) or PNG with automatic tool selection. Use when user asks to "compress image", "optimize image", "convert to webp", or red...

0· 1k·45 current·46 all-time
byJim Liu 宝玉@jimliu

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jimliu/baoyu-compress-image.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Baoyu Compress Image" (jimliu/baoyu-compress-image) from ClawHub.
Skill page: https://clawhub.ai/jimliu/baoyu-compress-image
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install baoyu-compress-image

ClawHub CLI

Package manager switcher

npx clawhub@latest install baoyu-compress-image
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the included scripts and CLI behavior. Required runtimes (bun or npx) are consistent with running a TypeScript script packaged with the skill. No unrelated binaries, credentials, or config paths are requested.
Instruction Scope
SKILL.md only instructs running the included script and reading optional EXTEND.md config files from project/XDG/home locations — behavior appropriate for user-configurable tooling. The script performs filesystem operations (recursing directories, renaming originals to *_original when --keep is false, and writing output files). This file-modifying behavior is expected but could be surprising if users assume originals are preserved by default.
Install Mechanism
No install spec or remote downloads are present. The script is included in the bundle and relies on local runtime (bun or npx); there is no network fetch in the provided files.
Credentials
No environment variables or secrets are requested. The skill reads configuration files from standard user/project config locations (EXTEND.md) which is proportional to its purpose. It does spawn external image tools (sips, cwebp, convert) and dynamically imports 'sharp' if needed — requiring those tools or packages is reasonable for image processing but may require users to install them.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request permanent platform-wide privileges or modify other skills' configurations.
Assessment
This skill appears to be a straightforward image compressor. Before installing or running it: 1) Be aware it modifies files — by default it replaces originals and renames the original to *_original unless you pass --keep; back up important images first. 2) You may need bun/npx and native tools (cwebp, ImageMagick 'convert', or the sharp Node module) installed for best behavior. 3) The skill reads EXTEND.md from project/XDG/home config locations for preferences — review those files if present. 4) There are no requested credentials or network calls in the bundle, but inspect runtime output/errors when first running it to confirm it behaves as expected.
scripts/main.ts:32
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Any binbun, npx
latestvk974qptsz61wtte4k9dxvgmmk9858gtj
1kdownloads
0stars
5versions
Updated 9h ago
v1.103.2
MIT-0

Image Compressor

Compresses images using best available tool (sips → cwebp → ImageMagick → Sharp).

Script Directory

Scripts in scripts/ subdirectory. {baseDir} = this SKILL.md's directory path. Resolve ${BUN_X} runtime: if bun installed → bun; if npx available → npx -y bun; else suggest installing bun. Replace {baseDir} and ${BUN_X} with actual values.

ScriptPurpose
scripts/main.tsImage compression CLI

Preferences (EXTEND.md)

Check EXTEND.md in priority order — the first one found wins:

PriorityPathScope
1.baoyu-skills/baoyu-compress-image/EXTEND.mdProject
2${XDG_CONFIG_HOME:-$HOME/.config}/baoyu-skills/baoyu-compress-image/EXTEND.mdXDG
3$HOME/.baoyu-skills/baoyu-compress-image/EXTEND.mdUser home

If none found, use defaults.

EXTEND.md supports: Default format, default quality, keep-original preference.

Usage

${BUN_X} {baseDir}/scripts/main.ts <input> [options]

Options

OptionShortDescriptionDefault
<input>File or directoryRequired
--output-oOutput pathSame path, new ext
--format-fwebp, png, jpegwebp
--quality-qQuality 0-10080
--keep-kKeep originalfalse
--recursive-rProcess subdirsfalse
--jsonJSON outputfalse

Examples

# Single file → WebP (replaces original)
${BUN_X} {baseDir}/scripts/main.ts image.png

# Keep PNG format
${BUN_X} {baseDir}/scripts/main.ts image.png -f png --keep

# Directory recursive
${BUN_X} {baseDir}/scripts/main.ts ./images/ -r -q 75

# JSON output
${BUN_X} {baseDir}/scripts/main.ts image.png --json

Output:

image.png → image.webp (245KB → 89KB, 64% reduction)

Extension Support

Custom configurations via EXTEND.md. See Preferences section for paths and supported options.

Comments

Loading comments...