Skills generate-image

📦

generate-image

Name: generate-image
Author: davila7

Content revision r2 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands

Generate and Edit Images with OpenRouter

Creating polished visual assets can require separate tools and model-specific workflows. This skill generates or edits images through OpenRouter and saves the result locally.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "generate-image" from https://skillstore.io/skills/davila7-generate-image.md and its manifest at https://skillstore.io/api/skills/davila7-generate-image/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/davila7-generate-image.md Signed manifest GET /api/skills/davila7-generate-image/manifest Signed lockfile GET /api/skills/davila7-generate-image/lockfile

Test it

Using "generate-image". Create a clean editorial photograph of a ceramic lamp on a white studio background.

Expected outcome:

The skill requests the image and saves the first returned result as the selected PNG file.

Using "generate-image". Change the background of product.jpg to pale gray while preserving the product colors.

Expected outcome:

The source image is sent with the edit request, and the returned image is saved to the selected path.

Using "generate-image". Create a scientific concept illustration of immune cells approaching a tumor.

Expected outcome:

The skill produces a conceptual illustration for review, not a precise technical or diagnostic diagram.

Security Audit

High Risk

v10 • 7/23/2026 Open versioned report

The skill sends prompts and optional input images to OpenRouter, then writes generated image data to a selected local path. Most external-command alerts are Markdown formatting, and most key alerts reference placeholders or ordinary parameter handling. Parent credential discovery, command-line secrets, image uploads, and unrestricted output paths need stronger consent and scope controls.

Files scanned

461

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

High

scripts/generate_image.py:24

Environment file access

# Look for .env in current directory and parent directories

The code intentionally searches the current directory and every parent for .env files. This can select credentials outside the active project.

High

scripts/generate_image.py:27

Environment file access

env_file = parent / ".env"

This constructs a .env path for each ancestor visited by the loop. The search has no repository or workspace boundary.

High

SKILL.md:46

Environment file access

1. Look for a `.env` file in the project directory or parent directories

The instructions explicitly direct the agent to search project and parent directories for .env files. Parent traversal can expose unrelated credentials.

High

SKILL.md:47

Environment file access

2. Check for `OPENROUTER_API_KEY=<key>` in the `.env` file

The instructions direct the agent to inspect a .env file for a named secret. This creates sensitive-file access beyond merely documenting setup.

Medium

scripts/generate_image.py:38-60 scripts/generate_image.py:117-160

Local Images Are Uploaded Without Separate Confirmation

The edit path reads any supplied local image, embeds its contents, and sends it to OpenRouter. An autonomous invocation could disclose a sensitive image without separate upload confirmation.

The code directly reads the selected file, converts it to a data URL, and includes that data in the fixed OpenRouter request.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/generate_image.py:31

Generic API/secret keys

if line.startswith('OPENROUTER_API_KEY='):

This line identifies OPENROUTER_API_KEY inside a discovered .env file. The surrounding function searches every parent directory, expanding credential access beyond the project.

High

scripts/generate_image.py:32

Generic API/secret keys

api_key = line.split('=', 1)[1].strip().strip('"').strip("'")

This line extracts the OpenRouter credential as plaintext from a discovered .env file. The value comes from an unbounded parent-directory search.

High

scripts/generate_image.py:34

Generic API/secret keys

return api_key

This returns a credential found through the parent-directory search for later network use. The secret source is not restricted to the current project.

High

scripts/generate_image.py:103

Generic API/secret keys

api_key = check_env_file()

This invokes the .env discovery routine whenever no key argument is supplied. That routine searches the current directory and all ancestors.

High

scripts/generate_image.py:275

Generic API/secret keys

api_key=args.api_key,

This passes a secret supplied through the --api-key command-line option. Command-line secrets can remain visible in shell history and process listings.

High

SKILL.md:47

Generic API/secret keys

2. Check for `OPENROUTER_API_KEY=<key>` in the `.env` file

The skill instructs the agent to inspect .env content for an OpenRouter credential. This is real secret access, even though it supports expected API authentication.

Medium

scripts/generate_image.py:71

Python file write/append

with open(output_path, 'wb') as f:

The script opens the caller-selected output path in write mode. It can replace an existing file without confirmation.

Low

scripts/generate_image.py:144

Python HTTP libraries

response = requests.post(

The request sends prompts and optional image data to OpenRouter. This is expected functionality, but it creates a real external data transfer.

Low

scripts/generate_image.py:145

Hardcoded URL

url="https://openrouter.ai/api/v1/chat/completions",

This is the fixed OpenRouter API endpoint used for image requests. The destination is not user-controlled, but outbound transfer is a real capability.

Risk Factors

🌐 Network access (5)

scripts/generate_image.py:144 scripts/generate_image.py:111 scripts/generate_image.py:145 SKILL.md:51 SKILL.md:164

📁 Filesystem access (1)

scripts/generate_image.py:71

🔑 Env variables (18)

scripts/generate_image.py:23 scripts/generate_image.py:31 scripts/generate_image.py:32 scripts/generate_image.py:33 scripts/generate_image.py:34 scripts/generate_image.py:79 scripts/generate_image.py:89 scripts/generate_image.py:102 scripts/generate_image.py:103 scripts/generate_image.py:105 scripts/generate_image.py:106 scripts/generate_image.py:108 scripts/generate_image.py:110 scripts/generate_image.py:147 scripts/generate_image.py:275 SKILL.md:47 SKILL.md:49 SKILL.md:50

⚙️ External commands (39)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/davila7-generate-image/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/davila7-generate-image/security.svg)](https://skillstore.io/skills/davila7-generate-image?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/davila7-generate-image?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-generate-image/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/davila7-generate-image.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

davila7. (2026). generate-image security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-generate-image/audits/10

BibTeX citation

@techreport{davila7-davila7-generate-image-2026,
  author = {davila7},
  title = {generate-image security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/davila7-generate-image/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "generate-image security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-generate-image/audits/10"
identifiers:
  - type: other
    value: "skillstore:davila7-generate-image:audit:10"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

K-Dense-AI Recommended

k-dense-ai-generate-image

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 17

Updated

2026-08-21

davila7 Current

davila7-generate-image

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 12

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create Concept Visuals

Generate focused artwork or photorealistic references for early design exploration.

Illustrate Research Materials

Create nontechnical concept images for presentations, posters, and explanatory documents.

Adapt Existing Assets

Change backgrounds, colors, objects, or styling while preserving requested source elements.

Try These Prompts

Create a Simple Image

Generate a [style] image of [subject]. Save it to [output path].

Control Composition

Generate [subject] with [lighting], [camera angle], [color palette], and [background]. Save it to [output path].

Edit an Existing Image

Edit [input image] by changing [target detail] to [desired result]. Preserve [unchanged elements] and save to [output path].

Direct an Advanced Edit

Edit [input image] with [model], preserve [elements], change [details], and save to [output path]. Do not alter [protected elements].

Best Practices

Review prompts and input images for sensitive information before sending them to OpenRouter.
Use explicit output paths and confirm that existing files may be replaced.
Choose a model after checking its current availability, capabilities, and pricing.

Avoid

Do not pass API keys on the command line or include them in prompts.
Do not upload confidential images without authorization and provider review.
Do not use this skill for precise technical diagrams or regulated visual evidence.

Frequently Asked Questions

Does this skill require an OpenRouter account?

Yes. Image requests require a valid OpenRouter API key and may incur provider charges.

Are prompts and images processed locally?

No. Prompts and editing images are sent to OpenRouter, while returned image data is saved locally.

Which input image formats are supported?

The script recognizes PNG, JPEG, GIF, and WebP extensions for image editing.

Can I select a different model?

Yes. Provide an OpenRouter model identifier, but verify current generation and editing support first.

Can this skill create technical diagrams?

It can create conceptual visuals, but a schematic-focused skill is better for precise technical diagrams.

Can the output replace an existing file?

Yes. The current script opens the selected output path in write mode without an overwrite prompt.

Developer Details

Author

davila7

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/davila7/claude-code-templates/tree/main/cli-tool/components/skills/scientific/generate-image

Ref

c43861a65bb95efcae259cd161c9d6f4dc7eec6f

Maintenance freshness

7/24/2026

Usage

9 downloads · 260 views

File structure

📁 scripts/

📄 generate_image.py

📄 SKILL.md