Skills generate-assets

📦

generate-assets

Name: generate-assets
Author: AayushBaniya2006

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Generate Web Assets with Replicate

Creating consistent website imagery can slow down component work. This skill generates, optimizes, and saves WebP assets with Replicate and Sharp.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "generate-assets" from https://skillstore.io/skills/aayushbaniya2006-generate-assets.md and its manifest at https://skillstore.io/api/skills/aayushbaniya2006-generate-assets/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/aayushbaniya2006-generate-assets.md Signed manifest GET /api/skills/aayushbaniya2006-generate-assets/manifest Signed lockfile GET /api/skills/aayushbaniya2006-generate-assets/lockfile

Test it

Using "generate-assets". Create a 16:9 hero image for a financial dashboard.

Expected outcome:

A polished dashboard hero image is generated, optimized as WebP, and saved in the hero assets folder.

Using "generate-assets". Generate a transparent decorative star cluster for a foreground layer.

Expected outcome:

A foreground WebP asset is created with the background removed and transparency preserved.

Using "generate-assets". Refresh an existing feature image while keeping the same dimensions.

Expected outcome:

The existing image dimensions are detected, and the replacement asset is generated at a matching aspect ratio.

Security Audit

High Risk

v8 • 7/6/2026 Open versioned report

Most static command and environment-file alerts are false positives from Markdown backticks, TypeScript template literals, and setup instructions. Real issues remain in the asset script: unvalidated folder and filename arguments can write outside the intended images directory, and generated image URLs are downloaded without host validation. The skill also disables moderation for background removal and instructs unpinned dependency installs.

Files scanned

678

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

scripts/generate-asset.ts:194-209 scripts/generate-asset.ts:381-388

Path Traversal Write Risk

The script accepts folder and filename from CLI arguments and joins them into output paths without bounding them to public/assets/images. A crafted value can create directories or write a .webp outside the intended asset directory.

The folder and filename arguments directly influence targetDir and filePath. The code then calls mkdirSync and writeFileSync without rejecting absolute paths or .. traversal.

Medium

scripts/generate-asset.ts:309-315

Content Moderation Disabled For Background Removal

The background removal request sets content_moderation to false when transparent assets are generated. This can process unsafe image content without the provider moderation gate.

The provider request explicitly sets content_moderation: false. The behavior is limited to the background removal branch, so the confidence is high but scoped.

Medium

SKILL.md:23-24

Unpinned Dependency Installation Instructions

The skill instructs users to run pnpm add replicate and pnpm add sharp -D without versions. This modifies the project dependency graph and pulls current package releases at install time.

The installation commands are explicit and unpinned. The risk is supply-chain and project mutation rather than direct malicious behavior.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/generate-asset.ts:383

Node.js fs operations

fs.mkdirSync(targetDir, { recursive: true });

mkdirSync creates targetDir recursively, and targetDir is built from the unvalidated folder CLI argument. A traversal folder can create directories outside public/assets/images.

High

scripts/generate-asset.ts:388

Node.js fs operations

fs.writeFileSync(filePath, optimizedImage);

writeFileSync writes to filePath built from unvalidated folder and filename arguments. This can write a .webp file outside the intended asset directory through path traversal.

High

scripts/generate-asset.ts:388

Synchronous file operations

fs.writeFileSync(filePath, optimizedImage);

The synchronous write uses the same unvalidated filePath as the filesystem write finding. The real risk is an arbitrary-path .webp write outside the intended asset directory.

Low

scripts/generate-asset.ts:298

Fetch API call

const response = await fetch(imageUrl);

The script downloads a URL returned by the image generation service, creating outbound network access. The URL is not allowlisted before fetch, so an unexpected service response could cause unintended downloads.

Low

scripts/generate-asset.ts:348

Fetch API call

const response = await fetch(transparentUrl);

The transparent image download fetches a URL returned by the background removal service. The destination is not validated, which leaves unintended outbound downloads possible if the response is manipulated.

Low

scripts/generate-asset.ts:141

Node.js fs stat operations

if (!fs.existsSync(imagePath)) {

existsSync checks a path derived from user-controlled filename and folder arguments to infer image dimensions. Without path normalization, this can probe paths outside the intended image directory.

Low

scripts/generate-asset.ts:382

Node.js fs stat operations

if (!fs.existsSync(targetDir)) {

existsSync checks a target directory derived from the folder argument. Because the folder is not bounded to public/assets/images, traversal paths can be probed.

Risk Factors

⚙️ External commands (46)

🌐 Network access (2)

scripts/generate-asset.ts:298 scripts/generate-asset.ts:348

📁 Filesystem access (5)

scripts/generate-asset.ts:383 scripts/generate-asset.ts:388 scripts/generate-asset.ts:141 scripts/generate-asset.ts:382 scripts/generate-asset.ts:388

🔑 Env variables (4)

scripts/generate-asset.ts:7 scripts/generate-asset.ts:18 scripts/generate-asset.ts:7 scripts/generate-asset.ts:18

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/aayushbaniya2006-generate-assets/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/aayushbaniya2006-generate-assets/security.svg)](https://skillstore.io/skills/aayushbaniya2006-generate-assets?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/aayushbaniya2006-generate-assets?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aayushbaniya2006-generate-assets/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/aayushbaniya2006-generate-assets.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AayushBaniya2006. (2026). generate-assets security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/aayushbaniya2006-generate-assets/audits/8

BibTeX citation

@techreport{aayushbaniya2006-aayushbaniya2006-generate-assets-2026,
  author = {AayushBaniya2006},
  title = {generate-assets security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/aayushbaniya2006-generate-assets/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "generate-assets security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "AayushBaniya2006"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/aayushbaniya2006-generate-assets/audits/8"
identifiers:
  - type: other
    value: "skillstore:aayushbaniya2006-generate-assets:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create page hero imagery

Generate wide WebP images for landing pages, dashboards, and product sections.

Explore feature visuals

Produce square or rectangular concept images for cards, feature blocks, and interface previews.

Prepare transparent decorations

Create foreground assets with removed backgrounds for accents, icons, and visual polish.

Try These Prompts

Basic hero asset

Generate an asset for a modern analytics dashboard hero section with a clean interface and bright product focus.

Feature card image

Create a feature showcase image for AI content generation with real-time preview, polished UI panels, and a square aspect ratio.

Transparent foreground element

Generate a transparent foreground asset with subtle stars and geometric accents for a SaaS landing page.

Replace existing visual

Replace the existing transformation image with a before-and-after workflow visual and match the current file dimensions.

Best Practices

Describe the main subject, page context, and intended component type in each prompt.
Use named folders that match asset purpose, such as hero, features, or foreground.
Review generated images before publishing them in user-facing pages.

Avoid

Do not use vague prompts when the asset must represent a specific product or workflow.
Do not pass untrusted folder or filename values without validating the output path.
Do not assume generated images meet brand, accessibility, or legal requirements without review.

Frequently Asked Questions

What models does this skill use?

It uses FLUX 1.1 Pro for generation and BRIA background removal for transparent assets.

Where are generated assets saved?

The script saves WebP files under public/assets/images, with optional subfolders for asset types.

Does it require an API key?

Yes. It requires REPLICATE_API_TOKEN in the environment before generation can run.

Can it match an existing image size?

Yes. If the target image exists, the script reads its dimensions and uses a matching aspect ratio.

Can it make transparent assets?

Yes. Transparent mode runs a background removal model and preserves alpha when possible.

Is it safe to use with any path values?

No. Folder and filename values should be validated before writing files in the current version.

Developer Details

Author

AayushBaniya2006

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/AayushBaniya2006/blinkfund/tree/main/.claude/skills/generate-assets

Ref

c1fdca50ff516318f65fed0d7f9e82797c5171dc

Maintenance freshness

7/18/2026

Usage

14 downloads · 215 views

File structure

📁 scripts/

📄 generate-asset.ts

📄 reference.md

📄 SKILL.md