Skills gpt-image-edit

📦

gpt-image-edit

Name: gpt-image-edit
Author: agentspace-so

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Edit Images with GPT Image 2 on RunComfy

Precise image edits often drift, especially when text, layout, or identity must stay stable. This skill provides RunComfy GPT Image 2 edit workflows with preservation-focused prompts.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "gpt-image-edit" from https://skillstore.io/skills/agentspace-so-gpt-image-edit.md and its manifest at https://skillstore.io/api/skills/agentspace-so-gpt-image-edit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentspace-so-gpt-image-edit.md Signed manifest GET /api/skills/agentspace-so-gpt-image-edit/manifest Signed lockfile GET /api/skills/agentspace-so-gpt-image-edit/lockfile

Test it

Using "gpt-image-edit". A product photo needs a warmer studio background while the product shape and label stay unchanged.

Expected outcome:

The skill returns a preservation-first edit prompt, recommends size auto, and prepares a RunComfy CLI workflow for the image URL.

Using "gpt-image-edit". A poster headline must change from English to Japanese while the rest of the poster remains fixed.

Expected outcome:

The skill quotes the exact replacement text, scopes the edit to the headline, and warns against changing the layout or brand mark.

Using "gpt-image-edit". A subject from one image should appear inside a room from another image with matching light.

Expected outcome:

The skill numbers each reference image, assigns subject and scene roles, and creates a prompt that preserves identity and matches lighting.

Security Audit

Medium Risk

v8 • 7/9/2026 Open versioned report

The skill is Markdown-only, and most static backtick, URL, and traversal detections are documentation false positives. Real risks remain because the skill instructs use of the RunComfy CLI, sends prompts and image URLs to a third-party API, and stores an API token in a hidden config path.

Files scanned

184

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:175-181

Third-Party Prompt And Image URL Processing

The skill states the CLI posts request data to RunComfy and that image URLs are fetched by the RunComfy model server. Users may expose prompts, image URLs, and generated outputs to a third-party service.

Lines 175 and 181 explicitly describe remote POST requests and server-side fetching of user-provided image URLs.

Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:179

Hidden file in home directory

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

Line 179 states runcomfy login writes an API token to ~/.config/runcomfy/token.json. Persisting credentials in a hidden home config file is real secret-storage behavior even with owner-only permissions.

Medium

SKILL.md:13

Ruby/shell backtick execution

`runcomfy run openai/gpt-image-2/edit` through the local RunComfy CLI.

Line 13 states the skill calls the local RunComfy CLI. That is intentional external process execution and should require user consent before sending data.

Medium

SKILL.md:26-28

Ruby/shell backtick execution

```bash

The fenced block includes an npx command that installs a community skill globally. Running npx or global install commands can execute package code and should not be automatic.

Medium

SKILL.md:45-46

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

Line 45 instructs installing the RunComfy CLI globally with npm. Global npm installs may run package lifecycle scripts and place commands on PATH.

Medium

SKILL.md:46-47

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

Line 46 instructs running runcomfy login, which starts authentication and prepares local credential use. This is expected behavior but security-sensitive.

Medium

SKILL.md:65-72

Ruby/shell backtick execution

```bash

The command block invokes the local RunComfy CLI with request data and an output directory. Execution sends image-edit data to a third-party model API.

Medium

SKILL.md:76-83

Ruby/shell backtick execution

```bash

The command block invokes the local RunComfy CLI with request data and an output directory. Execution sends image-edit data to a third-party model API.

Medium

SKILL.md:87-94

Ruby/shell backtick execution

```bash

The command block invokes the local RunComfy CLI with request data and an output directory. Execution sends image-edit data to a third-party model API.

Medium

SKILL.md:175

Ruby/shell backtick execution

The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The C

Line 175 confirms the skill invokes runcomfy run and the CLI posts to the RunComfy model API. This is real external command execution with outbound data transfer.

Medium

SKILL.md:179

Ruby/shell backtick execution

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

Line 179 describes runcomfy login writing an API token to a local config path. The command is legitimate, but it handles persistent credentials.

Medium

SKILL.md:175

Hardcoded URL

The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The C

Line 175 states the CLI posts to the RunComfy model API and downloads result URLs. This is intentional outbound network traffic carrying request data.

Medium

SKILL.md:179

Hidden file access

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

Line 179 states the RunComfy token is stored under ~/.config. That is expected CLI credential storage, but it is still access to a hidden credential file.

Risk Factors

⚙️ External commands (38)

🌐 Network access (7)

SKILL.md:16 SKILL.md:22 SKILL.md:69 SKILL.md:80 SKILL.md:91 SKILL.md:171 SKILL.md:175

📁 Filesystem access (6)

SKILL.md:40 SKILL.md:69 SKILL.md:80 SKILL.md:91 SKILL.md:179 SKILL.md:179

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentspace-so-gpt-image-edit/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentspace-so-gpt-image-edit/security.svg)](https://skillstore.io/skills/agentspace-so-gpt-image-edit?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentspace-so-gpt-image-edit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentspace-so-gpt-image-edit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentspace-so-gpt-image-edit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

agentspace-so. (2026). gpt-image-edit security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/agentspace-so-gpt-image-edit/audits/8

BibTeX citation

@techreport{agentspace-so-agentspace-so-gpt-image-edit-2026,
  author = {agentspace-so},
  title = {gpt-image-edit security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/agentspace-so-gpt-image-edit/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gpt-image-edit security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "agentspace-so"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/agentspace-so-gpt-image-edit/audits/8"
identifiers:
  - type: other
    value: "skillstore:agentspace-so-gpt-image-edit:audit:8"
    description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

runcomfy-com Recommended

runcomfy-com-gpt-image-edit

Skillstore Score 70

Evidence Confidence High

Skillstore usage 10

Updated

2026-08-21

agentspace-so Current

agentspace-so-gpt-image-edit

Skillstore Score 50

Evidence Confidence High

Skillstore usage 10

Updated

2026-08-21

doany-ai

doany-ai-gpt-image-edit

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Localize Campaign Images

Replace in-image headlines with exact translated text while preserving the original layout, brand mark, and product framing.

Create Brand-Safe Variants

Change backgrounds, calls to action, or layout positions while keeping faces, products, and brand elements stable.

Build Multi-Reference Composites

Combine a subject from one image with the setting, lighting, or color palette from other reference images.

Try These Prompts

Basic Background Edit

Use gpt-image-edit to keep the product unchanged and replace the background with a clean studio sweep. Use size auto.

Localized Headline Swap

Use gpt-image-edit to replace only the headline with the exact translated text I provide. Preserve the photograph, logo, layout, and font weight.

Two-Image Composition

Use gpt-image-edit with two image URLs. Keep the subject from image 1 and match the room lighting and color palette from image 2.

Production Edit Plan

Review my source image URLs, desired edits, protected elements, and output size. Produce a preservation-first edit prompt, RunComfy execution plan, and checks for drift.

Best Practices

Start each edit prompt with the faces, products, logos, layout, and framing that must remain unchanged.
Quote exact in-image text and name the writing system when replacing multilingual copy.
Use size auto unless the edit intentionally changes framing or aspect ratio.

Avoid

Combining many unrelated edits in one request, which increases visual drift.
Passing private image URLs without confirming they can be shared with RunComfy.
Paraphrasing replacement image text when the final copy must be exact.

Frequently Asked Questions

Does this skill edit images locally?

No. It uses the local RunComfy CLI to send requests to the RunComfy Model API.

What inputs does it need?

It needs an edit prompt, one or more publicly fetchable HTTPS image URLs, and an optional size setting.

How many reference images are supported?

The documented edit endpoint supports up to 10 image URLs, with the first image treated as primary.

Can it replace text inside an image?

Yes. The skill gives prompt guidance for exact multilingual text replacement while preserving the rest of the image.

Does it require credentials?

Yes. The RunComfy CLI requires login or a RUNCOMFY_TOKEN environment variable before requests can run.

When should another model be used?

Use another model for larger batch workflows, strongest portrait photorealism, or source-fidelity-first local edits.

Developer Details

Author

agentspace-so

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/agentspace-so/runcomfy-agent-skills/tree/main/gpt-image-edit/

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

6 downloads · 81 views

File structure

📄 SKILL.md