Security audit
Security checks across malware telemetry and agentic risk
The skill does compress images through a remote API, but it also reads broad .env files, persists API keys, and sends a machine-derived device identifier with insufficient user-facing disclosure.
Review this skill before installing. It sends image contents to a third-party NX API/CDN, may store your NX API key in a project .env file, searches parent and home .env files, and sends a stable device identifier derived from the machine unless you override it with --client or NX_CLIENT_ID. Avoid using it on sensitive images or in directories with unrelated secrets unless those behaviors are acceptable.
const fs=require('fs'),path=require('path'),os=require('os'),crypto=require('crypto');
// ===== 读取 .env 文件 =====
// 查找链: 当前目录逐级向上爬到根 → 兜底主目录 ~/.env，就近优先合并，已有环境变量优先
function findEnvFiles(){
const files=[];const files=[];
let dir=process.cwd();
while(true){
const candidate=path.join(dir,'.env');
if(fs.existsSync(candidate)) files.push(candidate);
const parent=path.dirname(dir);
if(parent===dir) break;if(parent===dir) break;
dir=parent;
}
const homeEnv=path.join(os.homedir(),'.env');
if(fs.existsSync(homeEnv)) files.push(homeEnv);
return files;
}VirusTotal findings are pending for this skill version.
Detected: suspicious.env_credential_access