Skills creative-media
📦

creative-media

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Create Media Assets with Luxin

Creating media across several providers requires separate credentials, billing, and workflows. This skill uses one hosted Luxin interface for images, video, audio, and 3D assets.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "creative-media" from https://skillstore.io/skills/danielgwilson-creative-media.md and its manifest at https://skillstore.io/api/skills/danielgwilson-creative-media/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/danielgwilson-creative-media.md Signed manifest GET /api/skills/danielgwilson-creative-media/manifest Signed lockfile GET /api/skills/danielgwilson-creative-media/lockfile

Test it

Using "creative-media". Find available image models without creating anything.

Expected outcome:

  • Available image models are grouped by generation, editing, speed, and estimated cost.
  • No media was created, and no credits were spent.

Using "creative-media". Prepare a square studio image of a compact field camera.

Expected outcome:

The guide reports required inputs, selected model options, expected cost, and the creation step awaiting user confirmation.

Using "creative-media". Recover the previous video task and summarize its result.

Expected outcome:

The recovered job summary includes status, selected model, hosted deliverable, model parameters, and cost receipt when available.

Security Audit

High Risk
v5 • 7/13/2026 Open versioned report

The 24 static alerts are false positives caused by Markdown backticks, literal URL references, and transparent workspace path examples. However, the skill directs agents to execute service-provided commands and mutable remote packages without independent validation or version pinning. Hosted retention and feedback submission also lack consent and redaction safeguards.

1
Files scanned
79
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (4)

High
SKILL.md:28
Execution of Service-Provided Commands
Line 28 tells the agent to run data.next_command when a service-provided boolean is true. A compromised response could direct arbitrary command execution without independent validation.
The prose explicitly delegates command selection and run permission to two fields returned by Luxin. No command allowlist or independent confirmation is required.
High
SKILL.md:33SKILL.md:39SKILL.md:47SKILL.md:53SKILL.md:66
Unpinned Remote Package and Skill Execution
The examples execute luxin-cli@latest and an unversioned skills package with automatic confirmation. They also install a skill from an unpinned repository reference.
The commands visibly use @latest, unversioned npx execution, and -y installation. These choices allow mutable remote content to execute without version review.
Medium
SKILL.md:24SKILL.md:28
Hosted Data Retention Without Confidentiality Safeguards
The skill directs agents to keep generated work in hosted Luxin for recovery. It does not require consent or warn against uploading confidential prompts and assets.
The text explicitly promotes durable hosted media and directs agents to retain generated work there. No privacy review, consent, retention, or deletion guidance appears.
Medium
SKILL.md:24SKILL.md:78
Potential Sensitive Data Disclosure Through Hosted Feedback
Line 78 instructs agents to submit attempted commands and task results through hosted feedback. It provides no redaction step for secrets, paths, prompts, or private data.
The skill identifies feedback as hosted and explicitly requests attempted command, expected behavior, and actual behavior. Those fields can contain sensitive task context.

Risk Factors

⚙️ External commands (13)
SKILL.md:24 SKILL.md:28 SKILL.md:32-34 SKILL.md:34-38 SKILL.md:38-40 SKILL.md:40-46 SKILL.md:46-48 SKILL.md:48-52 SKILL.md:52-54 SKILL.md:54-59 SKILL.md:59 SKILL.md:62-67 SKILL.md:67-78
🌐 Network access (8)
SKILL.md:5 SKILL.md:6 SKILL.md:10 SKILL.md:11 SKILL.md:73 SKILL.md:74 SKILL.md:75 SKILL.md:76
📁 Filesystem access (3)
SKILL.md:59 SKILL.md:63 SKILL.md:64
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/danielgwilson-creative-media/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/danielgwilson-creative-media/security.svg)](https://skillstore.io/skills/danielgwilson-creative-media?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/danielgwilson-creative-media?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/danielgwilson-creative-media/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/danielgwilson-creative-media.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

danielgwilson. (2026). creative-media security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/danielgwilson-creative-media/audits/5

BibTeX citation

@techreport{danielgwilson-danielgwilson-creative-media-2026, author = {danielgwilson}, title = {creative-media security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/danielgwilson-creative-media/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "creative-media security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "danielgwilson" date-released: "2026-07-13" url: "https://skillstore.io/skills/danielgwilson-creative-media/audits/5" identifiers: - type: other value: "skillstore:danielgwilson-creative-media:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
67
Community
83
Spec Compliance

What You Can Build

Produce Design Concepts

Generate visual concepts, edits, and 3D references through one hosted workflow.

Build Campaign Media

Coordinate image, video, and audio assets while tracking jobs, costs, and hosted deliverables.

Integrate Agent Media Workflows

Use structured model listings, recoverable jobs, and stable asset URLs in automated creative pipelines.

Try These Prompts

Explore Available Models 
List available Luxin models for [media type]. Do not create media or spend credits. Compare supported capabilities, required inputs, and expected costs.
Create a Guided Image 
Prepare a guided image request for [subject] in [style]. Show missing inputs and estimated cost. Ask for confirmation before any paid creation.
Plan a Multimodal Asset Set 
Plan an image, short video, and audio set for [project]. Reuse consistent creative direction. Confirm each paid step and return hosted deliverables.
Run a Recoverable Production Workflow 
Build a staged Luxin workflow for [campaign]. Select available models, cap total spend at [budget], track job identifiers, preserve receipts, and summarize failures safely.

Best Practices

  • Run model availability and guide steps before any paid creation.
  • Confirm prompts, source assets, estimated cost, and spending permission before starting media generation.
  • Review hosted assets and feedback for confidential content, then retain job identifiers and receipts.

Avoid

  • Do not execute a service-returned command without validation and explicit user confirmation.
  • Do not use mutable package versions or automatically confirm global installations.
  • Do not submit secrets, private prompts, local paths, or confidential assets to hosted services.

Frequently Asked Questions

Do I need provider API keys?
No provider API keys are required. Luxin may save an optional restricted IMAGE_SKILL_TOKEN after signup.
Does this skill work offline?
No. Model discovery, generation, storage, payments, and feedback depend on hosted Luxin and package registry access.
Can commands spend money?
Media creation can consume Luxin credits. Confirm the estimated cost and user permission before running any paid step.
Where are generated results stored?
Luxin provides durable hosted URLs and recoverable job records. Review its current retention and deletion terms before using confidential material.
Can this skill run local media models?
No. The documented workflow uses the hosted Luxin runtime instead of a local model server.
How can I recover interrupted work?
Use the Luxin job record and stable identifiers to retrieve status, deliverables, parameters, and receipts.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/danielgwilson/image-skill-cli/tree/main/skills/creative-media

Ref

635f69fb8d2f4e6330ba47a4e5a0fb239c04d110

Maintenance freshness

7/20/2026

Usage

1 downloads · 1 views

File structure

📄 SKILL.md