Skills gpt-image-2

📦

gpt-image-2

Name: gpt-image-2
Author: runcomfy-com

Content revision r1 Safe ⚙️ External commands🌐 Network access📁 Filesystem access

Generate GPT Image 2 Assets on RunComfy

Teams need image prompts and edits that preserve text, layout, and brand details. This skill guides Claude, Codex, and Claude Code to use RunComfy's GPT Image 2 endpoints with clear size, edit, and privacy rules.

Supports: Claude Codex Code(CC)

🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "gpt-image-2" from https://skillstore.io/skills/runcomfy-com-gpt-image-2.md and its manifest at https://skillstore.io/api/skills/runcomfy-com-gpt-image-2/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/runcomfy-com-gpt-image-2.md Signed manifest GET /api/skills/runcomfy-com-gpt-image-2/manifest Signed lockfile GET /api/skills/runcomfy-com-gpt-image-2/lockfile

Test it

Using "gpt-image-2". A product hero request for a ceramic bottle with the label AQUA+.

Expected outcome:

A portrait product image saved to the selected output folder, with the bottle centered and the label text visible.

Using "gpt-image-2". A reference product photo and a request to replace the background with a clean studio setting.

Expected outcome:

An edited image that keeps the product shape and label while replacing the background and lighting.

Using "gpt-image-2". A poster localization request with a short Japanese headline.

Expected outcome:

A localized poster concept with the requested headline rendered on the sign area.

Security Audit

Safe

v6 • 7/9/2026 Open versioned report

Most static alerts are Markdown formatting false positives, including endpoint names, prompt examples, and API path placeholders. I confirmed intended RunComfy CLI commands and outbound Model API requests. They execute local tools and send user data to RunComfy. No prompt injection text or covert malicious intent was found in SKILL.md.

Files scanned

212

Lines analyzed

Review items

False positives ignored

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:9-10

Ruby/shell backtick execution

(Flux 2 / Nano Banana Pro / Seedream) instead. Calls `runcomfy run

The front matter says the skill calls the local RunComfy CLI. That is intended behavior, but it executes a local binary and can transmit user prompts or images to RunComfy.

Medium

SKILL.md:10

Ruby/shell backtick execution

openai/gpt-image-2/text-to-image` or `/edit` through the local

The front matter continues the RunComfy CLI endpoint reference. This is intended, but local CLI execution and external model submission remain security-relevant.

Medium

SKILL.md:24-26

Ruby/shell backtick execution

```bash

The fenced shell example installs the skill globally with npx from a GitHub source. The command is user-initiated documentation, but it carries supply-chain and local execution risk if copied.

Medium

SKILL.md:45-46

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

The prerequisite tells users to install the RunComfy CLI globally with npm. This is expected setup, but global package installation executes third-party code on the user machine.

Medium

SKILL.md:46-47

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

The prerequisite runs the RunComfy login command. That starts a local authentication flow and creates credential-handling risk, even though it is expected for this service.

Medium

SKILL.md:74-78

Ruby/shell backtick execution

```bash

The text-to-image example runs the local RunComfy CLI with user prompt input and an output directory. This is the intended workflow, but it is real external command execution.

Medium

SKILL.md:82-89

Ruby/shell backtick execution

```bash

The edit example runs the local RunComfy CLI with an edit instruction and image URL. This can send user data to a third-party model endpoint.

Medium

SKILL.md:93-100

Ruby/shell backtick execution

```bash

The multi-reference edit example runs the RunComfy CLI with multiple image URLs. This is legitimate, but it executes a local command and submits external references.

Medium

SKILL.md:106-109

Ruby/shell backtick execution

```bash

The pipe-friendly example runs RunComfy and pipes output to jq. The pipeline is documented and bounded, but it is still shell command execution.

Medium

SKILL.md:194-195

Ruby/shell backtick execution

1. The skill invokes `runcomfy run openai/gpt-image-2/<endpoint>` with a JSON body matching the sche

The implementation description states that the skill invokes runcomfy run for GPT Image 2 endpoints. This confirms intentional local CLI execution as part of normal operation.

Low

SKILL.md:195

Hardcoded URL

2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/<endpoint>` with th

The How it works section names the RunComfy Model API endpoint and says requests use the user bearer token. This is expected, but prompts, URLs, and auth metadata leave the local machine.

Risk Factors

⚙️ External commands (41)

🌐 Network access (6)

SKILL.md:14 SKILL.md:20 SKILL.md:86 SKILL.md:97 SKILL.md:190 SKILL.md:195

📁 Filesystem access (5)

SKILL.md:196 SKILL.md:197 SKILL.md:198 SKILL.md:207 SKILL.md:207

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/runcomfy-com-gpt-image-2/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/runcomfy-com-gpt-image-2/security.svg)](https://skillstore.io/skills/runcomfy-com-gpt-image-2?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/runcomfy-com-gpt-image-2?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/runcomfy-com-gpt-image-2/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/runcomfy-com-gpt-image-2.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

runcomfy-com. (2026). gpt-image-2 security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/runcomfy-com-gpt-image-2/audits/6

BibTeX citation

@techreport{runcomfy-com-runcomfy-com-gpt-image-2-2026,
  author = {runcomfy-com},
  title = {gpt-image-2 security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/runcomfy-com-gpt-image-2/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gpt-image-2 security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "runcomfy-com"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/runcomfy-com-gpt-image-2/audits/6"
identifiers:
  - type: other
    value: "skillstore:runcomfy-com-gpt-image-2:audit:6"
    description: "Skillstore immutable audit report identifier"

Compare variants

4 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

runcomfy-com Recommended Current

runcomfy-com-gpt-image-2

Skillstore Score 78

Evidence Confidence High

Skillstore usage 23

Updated

2026-08-21

doany-ai

doany-ai-gpt-image-2

Skillstore Score 69

Evidence Confidence High

Skillstore usage 32

Updated

2026-08-21

agentspace-so

agentspace-so-gpt-image-2

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 57

Updated

2026-08-21

prime-skills

prime-skills-gpt-image-2

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 2

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create Product Campaign Images

Generate product hero images with accurate labels, simple backgrounds, and brand-safe lighting.

Localize Visual Brand Assets

Adapt signs, packaging, and posters with short multilingual text while keeping layout consistent.

Draft Labeled Mockups

Create UI mockups, diagrams, and scientific illustrations where readable labels matter.

Try These Prompts

Create a Product Hero

Use GPT Image 2 on RunComfy to generate a portrait product image for [product]. Include exact label text "[text]". Use size 1024_1536.

Edit While Preserving Identity

Edit this reference image with GPT Image 2. Change [background or detail]. Keep the subject, face identity, pose, and framing unchanged.

Localize Brand Text

Use GPT Image 2 to create [number] variants of this asset with headline "[translated text]". Keep layout, colors, and product placement consistent.

Compose a Multi-Reference Ad

Use image 1 as the product, image 2 as the room, and image 3 as lighting reference. Create a [format] ad with exact headline "[headline]".

Best Practices

Quote exact embedded text and keep it short.
Use auto size for edits unless the framing must change.
Change one attribute per iteration to preserve composition.

Avoid

Do not combine conflicting instructions, such as no text and a required headline.
Do not place long paragraphs inside generated images.
Do not include secrets or private image URLs in prompts.

Frequently Asked Questions

Do I need an OpenAI API key?

No. The skill uses RunComfy, so you need a RunComfy account or token.

Which image sizes are supported?

Text-to-image supports 1024_1024, 1024_1536, and 1536_1024. Edit also supports auto size.

Can it edit more than one reference image?

Yes. The edit endpoint supports up to 10 publicly fetchable HTTPS reference images.

Where is the RunComfy token stored?

The RunComfy CLI stores login tokens under the user config directory. CI can use RUNCOMFY_TOKEN instead.

Does this skill send data to an external service?

Yes. Prompts and reference image URLs are sent to the RunComfy Model API.

Is it best for photorealistic portraits?

No. The skill says GPT Image 2 is stronger for text, layout, signage, and brand assets.

Developer Details

Author

runcomfy-com

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/runcomfy-com/skills/tree/main/gpt-image-2/

Ref

0519034dad657fb1f7706e0550e962beeda73fdf

Maintenance freshness

7/18/2026

Usage

17 downloads · 0 views

File structure

📄 SKILL.md