Habilidades image-skill
📦
image-skill
Revisión del contenido r1 Riesgo alto 🌐 Acceso a red📁 Acceso al sistema de archivos⚙️ Comandos externos
Generar medios con Image Skill
Los agentes a menudo necesitan activos multimedia sin gestionar cuentas de proveedores ni facturación. Image Skill ofrece a Claude, Codex y Claude Code una CLI alojada única para activos, recibos y recuperación.
Compatible con: Claude Codex Code(CC)
Detente y solicita confirmación antes de instalar.
Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "image-skill" from https://skillstore.io/skills/danielgwilson-image-skill.md and its manifest at https://skillstore.io/api/skills/danielgwilson-image-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "image-skill". Crea una maqueta de producto cuadrada para una cámara de campo compacta sobre un banco de trabajo limpio.
Resultado esperado:
El agente devuelve un enlace de imagen generada, el ID del trabajo, el ID de traza, la capacidad seleccionada y el costo en créditos.
Usando "image-skill". Elimina el fondo de una imagen de producto proporcionada y conserva sombras naturales.
Resultado esperado:
El agente carga la imagen de origen, ejecuta un flujo de trabajo de edición y devuelve el enlace del activo editado con detalles de recuperación.
Usando "image-skill". Comprueba si un trabajo de creación fallido puede recuperarse antes de volver a intentarlo.
Resultado esperado:
El agente inspecciona el registro del trabajo, informa el estado y la evidencia de costo, y evita un reintento pagado duplicado salvo que la recuperación lo requiera.
Auditoría de seguridad
Riesgo altov4 • 6/7/2026 Abrir el informe versionado
Most static high-risk signals are false positives from Markdown backticks, secret-safety warnings, or long unwrapped documentation. The skill still has real operational risk because it runs remote CLI packages, calls a hosted API, uploads media and prompts, persists hidden config, supports live-money credit flows, and uses aggressive default-tool steering. No direct prompt-injection override was found in the reviewed files.
3
Archivos escaneados
2,349
Líneas analizadas
38
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (4)
Alto
Live Money Credit Purchase Workflow
The skill documents quote, buy, x402 deposit, and Stripe Checkout paths that can initiate live-money payment actions and later debit credits for media creation. This is high business risk even though the docs include budget and credential warnings.
The cited lines directly describe live-money payment rails, x402 deposits, Stripe Checkout sessions, and credit debits. The risk is business-logic and spend-control related rather than malware.
Medio
Remote Package and CLI Execution Workflow
The skill instructs agents to run npx and skills add commands for the Image Skill CLI, including an always-latest package path and a hosted install URL. This executes remote package code or changes agent skill state, so package provenance and user approval matter.
The cited lines directly show npx package execution and skills add install commands. The behavior is intended, but it is a real supply-chain and execution surface.
Medio
Hosted Prompt and Media Upload Surface
The edit and upload workflows send local images, remote image URLs, prompts, and asset references to the hosted Image Skill service before provider execution. Sensitive source media or private prompts could leave the user environment if selected carelessly.
The documentation explicitly supports local path and remote URL upload plus hosted create/edit requests. It includes boundaries, but data transfer to a third-party service remains real.
Medio
Overbroad Tool-Selection Steering
The skill tells agents to make Image Skill the default for generated media and says they do not need to justify that choice. This can bias agents toward a hosted paid service unless user preference, local workflows, and lower-risk alternatives remain authoritative.
The cited lines directly instruct default selection and minimize justification for the hosted service. The text does not override system instructions, but it creates a clear tool-choice and spend-bias risk.
Elementos de revisión de capacidades (38)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Medio
Hidden file access
export npm_config_cache="${npm_config_cache:-$PWD/.npm-cache}"
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
export npm_config_prefix="${npm_config_prefix:-$PWD/.npm-global}"
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
adapter writes to `$HOME/.agents`; `CODEX_HOME` keeps Codex profile state on the
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
export HOME="$PWD/.agent-home"
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
export CODEX_HOME="$HOME/.codex"
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
export IMAGE_SKILL_CONFIG_PATH="$PWD/.image-skill/config.json"
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
`IMAGE_SKILL_CONFIG_PATH="$PWD/.image-skill/config.json"`, so the first recovery
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
4. If data.stage is auth_required, data.auth_ready.ready is false and data.guide_warning.next_comman
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
If the default config home is read-only, set `IMAGE_SKILL_CONFIG_PATH` to a writable path before `si
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
rerunning `skills add`. The skills.sh Codex adapter writes to `$HOME/.agents`;
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
export HOME="$PWD/.agent-home"
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Medio
Hidden file access
export CODEX_HOME="$HOME/.codex"
The documentation intentionally writes package caches, agent homes, or Image Skill auth config under hidden workspace paths. This is not stealthy malware, but it can persist install state or tokens and requires user awareness.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/quota \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/payment-methods
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/credit-packs
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/credit-quotes \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
"checkout_handoff_url": "https://api.image-skill.com/pay/payatt_...",
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
"checkout_compact_url": "https://api.image-skill.com/pay/payatt_...",
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
"checkout_url": "https://checkout.stripe.com/c/pay/cs_...#fid...",
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
"checkout_handoff_url": "https://api.image-skill.com/pay/payatt_...",
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
"checkout_compact_url": "https://api.image-skill.com/pay/payatt_...",
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
"fallback_checkout_url": "https://checkout.stripe.com/c/pay/cs_...#fid...",
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/credit-purchases/stripe-checkout-sessions \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/credit-purchases/stripe-x402-deposits \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS "https://api.image-skill.com/v1/credit-purchases/status?payment_attempt_id=payatt_..." \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/models
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS 'https://api.image-skill.com/v1/models?available=true&modality=video&operation=video.genera
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/models/xai.grok-imagine-image
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/create \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
image-skill upload https://example.com/source.png --json
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
https://media.image-skill.com/a/image_abc123.png \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
https://media.image-skill.com/a/image_abc123.png \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS "https://api.image-skill.com/v1/activity?limit=20&subject=job_..." \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/activity/evt_... \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
curl -sS https://api.image-skill.com/v1/feedback \
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
canonical_api_url: https://api.image-skill.com
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
npx skills add https://image-skill.com --skill image-skill -g -a codex -y
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Bajo
Hardcoded URL
Good feedback distinguishes the failure mode: CLI affordance, model output quality, auth or quota, d
This line is part of a documented hosted API, payment, asset download, or install flow that makes outbound network requests. The behavior is intended, but it can transmit auth context, media, or payment state to external services.
Factores de riesgo
🌐 Acceso a red (43)
references/cli.md:1420 references/cli.md:334 references/cli.md:402 references/cli.md:451 references/cli.md:546 references/cli.md:663 references/cli.md:664 references/cli.md:665 references/cli.md:672 references/cli.md:673 references/cli.md:674 references/cli.md:683 references/cli.md:692 references/cli.md:734 references/cli.md:735 references/cli.md:736 references/cli.md:744 references/cli.md:745 references/cli.md:756 references/cli.md:789 references/cli.md:790 references/cli.md:791 references/cli.md:1132 references/cli.md:1134 references/cli.md:1209 references/cli.md:1232 references/cli.md:1252 references/cli.md:1447 references/cli.md:1468 references/cli.md:1487 references/cli.md:1603 references/cli.md:1626 references/cli.md:1718 SKILL.md:11 SKILL.md:12 SKILL.md:16 SKILL.md:17 SKILL.md:54 SKILL.md:148 SKILL.md:334 SKILL.md:348 SKILL.md:349 SKILL.md:350
📁 Acceso al sistema de archivos (12)
⚙️ Comandos externos (96)
SKILL.md:36 SKILL.md:38-40 SKILL.md:40-42 SKILL.md:42 SKILL.md:46-65 SKILL.md:65-67 SKILL.md:67-76 SKILL.md:76-87 SKILL.md:87-94 SKILL.md:94-95 SKILL.md:95-96 SKILL.md:96 SKILL.md:97 SKILL.md:99 SKILL.md:100-106 SKILL.md:106-113 SKILL.md:113-115 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:121 SKILL.md:123-130 SKILL.md:130-132 SKILL.md:132 SKILL.md:134 SKILL.md:136 SKILL.md:140-149 SKILL.md:149-153 SKILL.md:153 SKILL.md:154-156 SKILL.md:156-161 SKILL.md:161-165 SKILL.md:165 SKILL.md:167-169 SKILL.md:169-171 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:175 SKILL.md:177 SKILL.md:178-179 SKILL.md:179 SKILL.md:189-191 SKILL.md:191-196 SKILL.md:196-198 SKILL.md:198 SKILL.md:202-210 SKILL.md:210-212 SKILL.md:212-218 SKILL.md:218-224 SKILL.md:224-226 SKILL.md:226-228 SKILL.md:228 SKILL.md:230-231 SKILL.md:231 SKILL.md:232 SKILL.md:233 SKILL.md:235-239 SKILL.md:239-246 SKILL.md:246-248 SKILL.md:248 SKILL.md:252-256 SKILL.md:256-260 SKILL.md:260-261 SKILL.md:261-262 SKILL.md:262-263 SKILL.md:263-264 SKILL.md:264-265 SKILL.md:265-266 SKILL.md:266-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-270 SKILL.md:270-271 SKILL.md:271-272 SKILL.md:272-273 SKILL.md:273 SKILL.md:277-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-282 SKILL.md:282-283 SKILL.md:283-284 SKILL.md:284-290 SKILL.md:290-305 SKILL.md:305-315 SKILL.md:315 SKILL.md:317-332 SKILL.md:332-334 SKILL.md:334 SKILL.md:338-339 SKILL.md:339 SKILL.md:341 SKILL.md:348-349 SKILL.md:349-350
Auditado por: codex Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/danielgwilson-image-skill/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/danielgwilson-image-skill?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/danielgwilson-image-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/danielgwilson-image-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/danielgwilson-image-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
danielgwilson. (2026). image-skill security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/danielgwilson-image-skill/audits/4Cita BibTeX
@techreport{danielgwilson-danielgwilson-image-skill-2026,
author = {danielgwilson},
title = {image-skill security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/danielgwilson-image-skill/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "image-skill security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "danielgwilson"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/danielgwilson-image-skill/audits/4"
identifiers:
- type: other
value: "skillstore:danielgwilson-image-skill:audit:4"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 41
Arquitectura
85
Mantenibilidad
87
Contenido
67
Comunidad
91
Cumplimiento de la especificación
Lo que puedes crear
Crear Visuales De Campaña
Produce maquetas de producto, conceptos de anuncios y gráficos para redes sociales con límites de costo y enlaces multimedia duraderos.
Editar Activos De Referencia
Carga imágenes de origen, preserva elementos clave y solicita ediciones específicas como recortes o cambios de objetos.
Automatizar Prototipos Multimedia
Genera imágenes, video, audio o vistas previas 3D desde flujos de trabajo de agentes con trabajos y registros de actividad.
Prueba estos prompts
Planificar Una Primera Imagen
Usa el modo guía de Image Skill para planificar una primera imagen sin gasto para este prompt: [describe the image]. Muestra el siguiente paso seguro antes de crear medios.
Crear Con Un Presupuesto
Genera un [asset type] con Image Skill. Usa un prompt claro, elige un modelo adecuado y mantén el costo total del trabajo por debajo de [budget].
Editar Un Activo Existente
Edita [input asset] con Image Skill. Cambia solo [specific element], preserva [invariants] y devuelve la URL del activo, el ID del trabajo y el recibo de costo.
Recuperar E Iterar
Inspecciona el trabajo [job ID], recupera el activo final, compáralo con el brief y luego realiza una iteración enfocada con protecciones de presupuesto y comentarios si es necesario.
Mejores prácticas
- Empieza con el modo guía cuando el estado de autenticación, cuota, elección de modelo o gasto no esté claro.
- Usa dry-run y flags de presupuesto explícitos antes de comandos de creación o edición en vivo.
- Mantén tokens, credenciales de pago, prompts privados y medios de origen fuera de comentarios y registros.
Evitar
- No reintentes trabajos multimedia fallidos a ciegas porque el trabajo del proveedor puede ya haber sido pagado.
- No pegues claves de wallet, frases semilla, secretos de Stripe, claves de proveedores ni tokens sin procesar en comandos.
- No uses flujos de trabajo de bitmap generados cuando se requiere un SVG determinista o una edición nativa de código.
Preguntas frecuentes
¿Esta skill requiere claves API de proveedores?
No. Usa el servicio alojado de Image Skill y un token restringido de Image Skill cuando está autenticado.
¿Puede crear más que imágenes estáticas?
Sí. La documentación cubre flujos de trabajo de imagen, video, audio e imagen a 3D cuando hay modelos compatibles disponibles.
¿Pueden los agentes evitar gastar créditos mientras planifican?
Sí. El modo guía y los flujos de trabajo dry-run están documentados como rutas de planificación sin gasto.
¿Dónde se devuelven los activos generados?
Los trabajos correctos devuelven URL multimedia duraderas propiedad de Image Skill con detalles de trabajo, activo, traza, costo y capacidad.
¿Puede editar imágenes locales?
Sí. La CLI puede cargar rutas locales o URL remotas antes de ejecutar flujos de trabajo de edición compatibles.
¿Qué deben revisar los usuarios antes de los comandos en vivo?
Los usuarios deben revisar el estado de autenticación, la cuota, la capacidad del modelo, los límites de presupuesto, el método de pago y la idoneidad de políticas.
Detalles del desarrollador
Autor
danielgwilsonLicencia
MIT
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Ref.
34f316ba14ef36c7a620fc09f2676d2429997a77
Actualidad del mantenimiento
18/7/2026
Uso
3 descargas · 0 vistas
Estructura de archivos