Skills image-edit
📦
image-edit
Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Edit Images with RunComfy Model Routing
Image editing requests often need different models for text, identity, masks, and batch work. This skill selects the right RunComfy route and gives model-specific edit guidance.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "image-edit" from https://skillstore.io/skills/doany-ai-image-edit.md and its manifest at https://skillstore.io/api/skills/doany-ai-image-edit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "image-edit". A designer asks to replace a product photo background while preserving the item shape and label.
Expected outcome:
The skill selects a general edit route, prioritizes identity preservation, and returns edited image files in the requested output directory.
Using "image-edit". A localization team asks to change an English poster headline to Japanese while keeping the layout intact.
Expected outcome:
The skill selects GPT Image 2 Edit, keeps the visual layout stable, and replaces only the in-image headline text.
Using "image-edit". A production artist provides an image and mask to remove overhead cables from a street scene.
Expected outcome:
The skill selects Z-Image Turbo Inpaint, uses a cleanup strength setting, and preserves surrounding rooflines and sky tone.
Security Audit
Medium Riskv4 • 7/5/2026 Open versioned report
Most static findings are Markdown formatting, placeholder URLs, or documented setup text rather than hidden code execution. Confirmed risks are intentional RunComfy CLI execution, third-party cloud processing of prompts and image URLs, and a cross-repository install instruction that should be verified.
1
Files scanned
271
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Third-Party Image and Prompt Disclosure
The skill sends prompts and image references to the RunComfy Model API, and RunComfy servers fetch image or mask URLs. This is expected for cloud editing, but users must understand the data disclosure.
The file explicitly says the CLI posts to the Model API and that model servers fetch image and mask URLs.
Medium
Cross-Repository Installation Instruction
The skill directs installation from agentspace-so/runcomfy-skills. A marketplace package should verify this external repository path to avoid source confusion or supply-chain substitution.
The GitHub link and npx install command name agentspace-so/runcomfy-skills, which is a clear external repository reference.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
iterations on the wrong model. Calls `runcomfy run <vendor>/<model>/edit`
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
```bash
This Markdown range instructs installation through npm or npx, which executes external package tooling. The command is expected setup, but it is a real supply-chain and command execution surface.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
This Markdown range instructs installation through npm or npx, which executes external package tooling. The command is expected setup, but it is a real supply-chain and command execution surface.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login`.
This line documents running the RunComfy CLI login flow, which executes local tooling and handles an API token. The behavior is intentional, but it is real command execution with credential impact.
Medium
Ruby/shell backtick execution
```bash
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
```bash
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
```bash
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
```bash
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
```bash
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
```bash
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
```bash
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
The skill picks one of Nano Banana Edit / GPT Image 2 Edit / Flux Kontext Pro / Z-Image Turbo Inpain
The skill intentionally invokes the local RunComfy CLI to submit image edit jobs and write outputs. This is expected functionality, but it is a real external command and network-backed workflow.
Medium
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
This line documents running the RunComfy CLI login flow, which executes local tooling and handles an API token. The behavior is intentional, but it is real command execution with credential impact.
Risk Factors
⚙️ External commands (61)
SKILL.md:13 SKILL.md:28-30 SKILL.md:30-52 SKILL.md:52-53 SKILL.md:53-54 SKILL.md:54-60 SKILL.md:60-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72-73 SKILL.md:73-77 SKILL.md:77-84 SKILL.md:84-88 SKILL.md:88-97 SKILL.md:97-101 SKILL.md:101-103 SKILL.md:103 SKILL.md:110-116 SKILL.md:116-117 SKILL.md:117-118 SKILL.md:118 SKILL.md:124-131 SKILL.md:131-135 SKILL.md:135-142 SKILL.md:142-146 SKILL.md:146 SKILL.md:147-148 SKILL.md:148 SKILL.md:149-155 SKILL.md:155-161 SKILL.md:161-162 SKILL.md:162-163 SKILL.md:163-164 SKILL.md:164-170 SKILL.md:170-177 SKILL.md:177-182 SKILL.md:182-189 SKILL.md:189-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:197-198 SKILL.md:198-199 SKILL.md:199-200 SKILL.md:200-201 SKILL.md:201-207 SKILL.md:207-217 SKILL.md:217-221 SKILL.md:221-230 SKILL.md:230-235 SKILL.md:235 SKILL.md:236 SKILL.md:237 SKILL.md:245 SKILL.md:262 SKILL.md:266 SKILL.md:267-269 SKILL.md:269
🌐 Network access (12)
📁 Filesystem access (11)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/doany-ai-image-edit/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/doany-ai-image-edit?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/doany-ai-image-edit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/doany-ai-image-edit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/doany-ai-image-edit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
doany-ai. (2026). image-edit security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/doany-ai-image-edit/audits/4BibTeX citation
@techreport{doany-ai-doany-ai-image-edit-2026,
author = {doany-ai},
title = {image-edit security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/doany-ai-image-edit/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "image-edit security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "doany-ai"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/doany-ai-image-edit/audits/4"
identifiers:
- type: other
value: "skillstore:doany-ai-image-edit:audit:4"
description: "Skillstore immutable audit report identifier"
Compare variants
4 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
runcomfy-com Recommended
runcomfy-com-image-edit
Skillstore Score 50
Evidence Confidence High
Skillstore usage 10
Updated
2026-08-21
doany-ai Current
doany-ai-image-edit
Skillstore Score 50
Evidence Confidence High
Skillstore usage 7
Updated
2026-08-21
agentspace-so-image-edit
Skillstore Score 38
Evidence Confidence High
Skillstore usage 9
Updated
2026-08-21
danielgwilson-image-edit
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 6
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
67
Community
83
Spec Compliance
What You Can Build
Create Consistent Product Variants
Batch edit product images while keeping aspect ratio, resolution, subject identity, and brand framing consistent.
Localize Campaign Visuals
Rewrite in-image headlines across languages while preserving the original photograph, layout, and brand mark.
Repair or Replace Image Regions
Use masks to remove distractions, replace backgrounds, or retouch selected regions with controlled strength.
Try These Prompts
Simple Background Swap
Edit the image at [image URL]. Keep the subject identity, pose, clothing, and framing unchanged. Replace only the background with [new background].
Batch Product Cleanup
Edit these product images: [image URLs]. Keep each product unchanged. Remove background clutter and use a clean light studio backdrop.
Multilingual Poster Rewrite
Edit the poster at [image URL]. Keep the photo, layout, and logo unchanged. Replace only the headline with [translated headline] in [script name].
Masked Region Replacement
Edit [image URL] using mask [mask URL]. Replace the masked region with [new content]. Preserve lighting, texture, perspective, and all unmasked areas.
Best Practices
- Start prompts with what must stay unchanged, then describe the edit.
- Use masks for precise object removal or region replacement.
- Lock aspect ratio and resolution when editing a batch.
Avoid
- Do not send private images or sensitive prompts without approval.
- Do not combine many unrelated edits in one prompt.
- Do not use low quality masks for precise inpainting work.
Frequently Asked Questions
Does this skill edit images locally?
No. It uses the local RunComfy CLI to send requests to RunComfy cloud models.
What credentials are required?
You need a RunComfy login or a RUNCOMFY_TOKEN value for CI and container use.
Can it edit multiple images at once?
Yes. Nano Banana Edit supports batch edits with 1 to 20 input image URLs.
Can it rewrite text inside an image?
Yes. The GPT Image 2 Edit route is intended for multilingual in-image text changes.
When should I use a mask?
Use a grayscale mask when the edit must affect only a specific object or region.
What happens to uploaded image URLs?
RunComfy model servers fetch the image and mask URLs needed to perform the requested edit.