Skills p-image
๐Ÿ“ฆ

p-image

Content revision r2 High Risk โš™๏ธ External commands๐ŸŒ Network access

Generate and Edit Images with P-Image

Image teams need fast generation and editing across several visual workflows. This skill runs Pruna P-Image models through the inference.sh belt CLI.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "p-image" from https://skillstore.io/skills/inferen-sh-p-image.md and its manifest at https://skillstore.io/api/skills/inferen-sh-p-image/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "p-image". Create a square studio photograph of white sneakers with soft lighting.

Expected outcome:

A completed P-Image generation result for a square product photograph.

Using "p-image". Change the background of the supplied portrait to a beach.

Expected outcome:

An edited image that keeps the portrait subject and replaces the background.

Using "p-image". Combine three supplied images into a wide promotional collage.

Expected outcome:

A composite image using all references in a wide layout.

Security Audit

High Risk
v5 โ€ข 8/6/2026 Open versioned report

Most static detections are Markdown backticks, fenced examples, or documentation links and are false positives. Unpinned skill installation commands and remote image loading remain real risks. The command templates also require safeguards against shell injection and disclosure of sensitive prompts or image URLs.

1
Files scanned
141
Lines analyzed
4
Review items
0
False positives ignored

Confirmed security concerns (2)

High
Shell Injection Through Prompt Interpolation
Examples place prompts and image URLs inside single-quoted shell arguments. Unescaped user input can terminate quoting and append commands.
The examples establish a repeatable shell template where user-supplied prompts or URLs replace literals. Single quotes inside those values would break the shown quoting boundary.
Medium
Remote Submission of User Content
The belt commands send prompts and referenced image URLs to hosted Pruna applications, potentially exposing sensitive content to an external service.
The skill states that belt uses inference.sh and the commands submit prompts and image references to hosted app identifiers. Remote processing is the documented purpose.
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 directs users to run an unpinned npx installer that can download executable code and add a third-party skill. This creates a supply-chain risk.
Medium
Ruby/shell backtick execution
```bash
This block directs users to run several unpinned npx skill installers from remote repositories. Mutable dependencies can introduce unreviewed instructions or code.
Low
Hardcoded URL
![P-Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kkgym0yqys
The embedded Markdown image can trigger an automatic request to cloud.inference.sh when the skill is rendered. That request exposes viewer network metadata to the remote host.
Low
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The installation link targets a mutable raw file on the main branch. Its instructions can change after review and influence users to execute new installation steps.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/inferen-sh-p-image/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/inferen-sh-p-image/security.svg)](https://skillstore.io/skills/inferen-sh-p-image?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/inferen-sh-p-image?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inferen-sh-p-image/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/inferen-sh-p-image.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

inferen-sh. (2026). p-image security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inferen-sh-p-image/audits/5

BibTeX citation

@techreport{inferen-sh-inferen-sh-p-image-2026, author = {inferen-sh}, title = {p-image security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/inferen-sh-p-image/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "p-image security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "inferen-sh" date-released: "2026-08-06" url: "https://skillstore.io/skills/inferen-sh-p-image/audits/5" identifiers: - type: other value: "skillstore:inferen-sh-p-image:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
85
Content
69
Community
83
Spec Compliance

What You Can Build

Create Product Visuals

Generate square studio images with controlled lighting and clear product details.

Edit Campaign Assets

Replace backgrounds or restyle existing images while preserving the source subject.

Prototype Visual Concepts

Compare aspect ratios, style presets, and models during rapid design exploration.

Try These Prompts

Generate a Basic Image
Create an image of [subject] in [setting] with [lighting] using P-Image.
Apply a Style Preset
Generate [subject] at [aspect ratio] with the [LoRA preset] style and [visual details].
Edit an Existing Image
Edit [image URL] by changing [target area] to [new appearance] while preserving [elements].
Build a Multi-Image Composite
Combine [image URLs] into [composition], match [lighting and palette], and use [aspect ratio].

Best Practices

  • Describe the subject, setting, lighting, composition, and desired aspect ratio.
  • Use shell-safe serialization for every prompt and image URL.
  • Review provider terms and remove sensitive data before remote processing.

Avoid

  • Do not place secrets, credentials, or private URLs in prompts.
  • Do not concatenate untrusted text directly into shell commands.
  • Do not assume a style preset preserves every source-image detail.

Frequently Asked Questions

What must be installed?
Install the belt CLI, authenticate with inference.sh, and ensure network access is available.
Which P-Image models are covered?
The skill covers P-Image, P-Image-LoRA, P-Image-Edit, and P-Image-Edit-LoRA.
Can it edit more than one image?
Yes. P-Image-Edit examples accept multiple image URLs for compositing.
Which aspect ratios are documented?
The skill lists square, landscape, portrait, and custom ratios.
Does it support custom LoRA files?
No custom loading workflow is documented. The skill lists built-in LoRA presets.
Is image content processed locally?
No. The belt commands use hosted inference.sh applications, so prompts and image references leave the local environment.

Developer Details

Author

inferen-sh

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

4121de961d1b6f2ffca856260e239505c302452c

Maintenance freshness

8/7/2026

Usage

7 downloads ยท 146 views

File structure

๐Ÿ“„ SKILL.md

More from inferen-sh

View all
View all