vision-squeezer

Our take

The product is real — a Rust image optimizer that snaps images to vision-LLM tile boundaries to cut token costs — but the npm install behavior crosses the line: postinstall silently copies Claude skill files into ~/.claude/skills with no consent gate, mutating an agent-behavior surface in your home directory the moment npm install finishes, and it downloads the platform binary from GitHub releases with no checksum verification. The Claude Code plugin-marketplace path is the consented way to get these skills; the npm path just takes the liberty. Install-time writes to agent config surfaces are a flag regardless of product quality.

reviewed by hand · 2026-07-06

Something wrong or dead here? Report it

Verification record

last verified

27 days ago

github stars

2

last commit

3 mo ago

archived

no

license

NOASSERTION

npm

vision-squeezer

latest version

0.6.1

in registry since

2026-07-22

github.com/eralpozcan/vision-squeezer