Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Job-Yang/jobbyang-ai-skills --skill png-compress-skillgit clone --depth 1 https://github.com/Job-Yang/jobbyang-ai-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/job-yang/jobbyang-ai-skills/png-compress-skill)<a href="https://agentmods.dev/skills/job-yang/jobbyang-ai-skills/png-compress-skill"><img src="https://agentmods.dev/badge/skills/job-yang/jobbyang-ai-skills/png-compress-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/job-yang/jobbyang-ai-skills/png-compress-skill"><img src="https://agentmods.dev/badge/skills/job-yang/jobbyang-ai-skills/png-compress-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Privilege Escalation · line 125 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.01892 |
| Opus 5 | $0.00033 | $0.00946 |
| Sonnet 5 | $0.00013 | $0.00378 |
| Haiku 4.5 | $0.00007 | $0.00189 |
Grade B, and why
png-compress scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Ubuntu:`sudo apt-get install pngquant` + `cargo install oxipng`(或下 GitHub release 二进制) How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PNG 批量压缩
这个技能能做什么
给它一个 App 工程或普通图片目录,它会:
- 自动递归找出所有 PNG(自动跳过 Pods / Carthage / build / DerivedData 等目录)
- 自动判断压没压过——用文件内容 hash 存本地缓存,压过的直接跳过,绝不二次量化毁图
- 自动压缩新增/改动的图,增量持续可用(缓存可提交进仓库,团队/CI 共享)
- 小图友好——20K 以下 icon 用更保守的质量下限,避免糊
- 变大回退——压完比原图还大就丢弃,保留原图(icon 常见)
- 压后自检——默认校验可解码/宽高不变/alpha 不丢,再用 PSNR/SSIM/MAE 做自动质量门禁;不通过就回退原图
- 动图保护——检测到 APNG 直接保留原图,不把动画误压成单帧
- 原地覆盖,不依赖具体 App、Target 或构建系统;多进程跑满 CPU
内核 = pngquant(有损量化,24/32bit → 8bit 调色板)+ oxipng(无损重编码和元数据清理)。这条路线与 TinyPNG 官方公开的“颜色量化 + 元数据清理”原理一致,但不声称复刻其未公开实现。
适用范围
- 不读取
.xcodeproj、Scheme、Bundle ID 或业务源码,不依赖任何特定业务工程或私有构建设施。 - 只要目录里有 PNG 就能运行;默认排除依赖目录和构建产物。
- 目标是 iOS App 源码资源,同样可以用于其他 App 或独立图片目录。
- 只处理静态 PNG;检测到 APNG 会保留原图。
怎么用
最简单:一键跑当前目录
./compress.sh
不传目录 = 默认当前目录递归。依赖(pngquant / oxipng)缺失时会自动尝试用 brew 安装。
指定工程目录
./compress.sh /path/to/iOSProject
只看效果不改文件(先预估收益)
./compress.sh /path/to/iOSProject --dry-run
指定并行数
./compress.sh /path/to/iOSProject -j 8
输出长啥样
扫描到 PNG: 1234 张 | 缓存已记录: 0 张 | 并行: 8
自检门禁: hard=on | quality=on | ssim=on
===== 完成 =====
压缩: 900 跳过(缓存): 0 保留原图(压不动): 330 跳过(APNG): 4 硬门禁回退: 0 质量门禁回退: 2 失败: 0
本轮压缩前: 45.2MB 压缩后: 12.8MB 节省: 32.4MB (71.7%)
耗时: 38.5s
再跑第二次,压过的全部走"跳过(缓存)",秒回。
实现细节(感兴趣再看)
脚本本体是 compress_images.py,compress.sh 只是加了依赖自检 + 自动安装的一层壳,两个交付形态(纯脚本 / 技能)复用同一份 compress_images.py。
核心命令(每张图):
# ① 有损量化,达不到质量或变大就放弃(退出码 98/99 视为正常)
pngquant --quality 65-85 --speed 1 --floyd=1.0 --strip --skip-if-larger \
--force --output out.png input.png
# ② 无损收尾:榨 DEFLATE + 删所有元数据
oxipng -o max --strip all -q out.png
压后自检(默认开启):
- 硬门禁: 用 Pillow(没有则退到 macOS
sips)解码原图和候选图,要求候选图可解码、宽高不变、原图有 alpha 时候选图不能丢 alpha、动画帧数不能变化。 - 质量门禁: 用 Pillow 计算 before/after 像素差异。默认阈值是
PSNR >= 28、SSIM >= 0.95(有 numpy 时启用)、MAE <= 12、alpha MAE <= 3。透明图会分别垫白底/黑底对比,避免只看透明像素导致误判。 - 动图保护: APNG 不进入有损量化,直接保留并写入缓存。
- 回退策略: 任何门禁不通过都保留原图,并把原图 hash 记入缓存,下次不再重复尝试。输出会打印
[HARD-GATE]或[QUALITY-GATE]的文件清单。
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 127 lines · 66 tokens per session scan B ea794172e50d
png-compress is a skill published in the GitHub repository Job-Yang/jobbyang-ai-skills (67 stars, last pushed 9d ago), licensed MIT. It adds 66 tokens to every session and 1,892 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…