Skills image-assistant

📦

image-assistant

Name: image-assistant
Author: yunshu0909

Content revision r1 Medium Risk 🌐 Network access🔑 Env variables⚙️ External commands

Create Readable 16:9 Image Prompts

Long articles often produce crowded images and weak prompts. This skill turns content into concise copy specs, layout plans, and reusable image generation prompts.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "image-assistant" from https://skillstore.io/skills/yunshu0909-image-assistant.md and its manifest at https://skillstore.io/api/skills/yunshu0909-image-assistant/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/yunshu0909-image-assistant.md Signed manifest GET /api/skills/yunshu0909-image-assistant/manifest Signed lockfile GET /api/skills/yunshu0909-image-assistant/lockfile

Test it

Using "image-assistant". A five-section article about choosing AI tools for a product team.

Expected outcome:

A three-image plan with a comparison card, a process comic, and a summary insight card.

Using "image-assistant". A confirmed slide outline for a workshop introduction.

Expected outcome:

A Copy Spec with exact title text, five roadmap labels, and a short bottom takeaway.

Using "image-assistant". Approved Copy Specs for two social media infographics.

Expected outcome:

Two ready-to-copy prompt packs using the same cream paper, colored pencil, and watercolor style.

Security Audit

Medium Risk

v5 • 7/8/2026 Open versioned report

I confirmed the real APIMart network and local token-handling surface in the batch script, while dismissing markdown formatting, file-tree, and high-entropy prose alerts as false positives. No prompt injection attempts or covert data-exfiltration instructions were found. The main residual concerns are single-confirmation API execution and shipping a live env-style config file.

Files scanned

1,121

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

stages/04-prompts.md:53-55 stages/04-prompts.md:76-79

Single-Confirmation External API Execution

Stage 4 instructs the agent to generate JSONL and execute batch API generation after the user selects batch API, without a second confirmation. That can send prompt content to APIMart and download remote content, so a final execution confirmation should be required.

The file explicitly says execution happens after one batch API selection and shows the command that runs the APIMart script. The behavior is visible and security-relevant, although it is not covert.

Low

scripts/apimart.env:1-4

Credential Config File Included in Package

The package includes scripts/apimart.env with a TOKEN field and a comment claiming it contains a real token, although the token is blank. Shipping a live env-style filename increases the chance that future credentials are committed or shared.

The file exists in the package and contains the TOKEN field, but the token value is empty. That supports a hygiene finding rather than evidence of exposed credentials.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

scripts/apimart_batch_generate.py:378

Hardcoded URL

api_url = config.get("API_URL", "https://api.apimart.ai/v1/images/generations").strip()

The script uses a real default APIMart image-generation endpoint. This is expected functionality, but prompt content leaves the local workspace when the script runs.

Low

scripts/apimart_batch_generate.py:378

Configuration library

api_url = config.get("API_URL", "https://api.apimart.ai/v1/images/generations").strip()

The API_URL is read from local configuration and controls the token-bearing request destination. This is legitimate configuration, but it affects where data is sent.

Low

scripts/apimart_batch_generate.py:380

Configuration library

token = config.get("TOKEN", "").strip()

The line reads a TOKEN value that is later used as a bearer token for APIMart requests. This is expected API authentication but still handles a local secret.

Low

scripts/apimart.env:2

Hardcoded URL

API_URL: https://api.apimart.ai/v1/images/generations

The local APIMart configuration contains a real external API endpoint. This supports the intended batch generation feature but confirms outbound network behavior.

Low

templates/api-config.md:6

Hardcoded URL

API_URL: https://api.apimart.ai/v1/images/generations

The template includes the real APIMart image-generation endpoint. This is transparent configuration, but it confirms external network use.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/yunshu0909-image-assistant/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/yunshu0909-image-assistant/security.svg)](https://skillstore.io/skills/yunshu0909-image-assistant?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/yunshu0909-image-assistant?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/yunshu0909-image-assistant/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/yunshu0909-image-assistant.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

yunshu0909. (2026). image-assistant security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/yunshu0909-image-assistant/audits/5

BibTeX citation

@techreport{yunshu0909-yunshu0909-image-assistant-2026,
  author = {yunshu0909},
  title = {image-assistant security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/yunshu0909-image-assistant/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "image-assistant security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "yunshu0909"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/yunshu0909-image-assistant/audits/5"
identifiers:
  - type: other
    value: "skillstore:yunshu0909-image-assistant:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Turn Articles Into Visual Plans

Convert a long article into a small set of focused infographic ideas before writing prompts.

Prepare Course or Workshop Slides

Create readable cover, roadmap, and explanation prompts for teaching material used on slides.

Build Consistent Prompt Packs

Package approved copy, layout rules, and style constraints into repeatable image generation prompts.

Try These Prompts

Plan One Image

Use image-assistant to turn this content into one 16:9 infographic plan. Ask only for missing audience, channel, and text-density details first.

Split a Long Article

Use image-assistant to split this article into a confirmed image list. For each image, give the purpose, content block, and recommended template.

Create Copy Specs

Use image-assistant stage 3 to create Copy Specs for the confirmed image list. Keep on-image text short and treat it as the final source of truth.

Package Batch Prompts

Use image-assistant stage 4 to turn the approved Copy Specs into prompt packs. Include style constraints, negative constraints, and a manual or batch API option.

Best Practices

Confirm audience, viewing distance, and text density before asking for final prompts.
Approve the Copy Spec before moving to prompt packaging or batch generation.
Keep one core message per image and use templates to preserve visual consistency.

Avoid

Do not put full paragraphs or dense explanations into one image prompt.
Do not change approved on-image text during the prompt packaging stage.
Do not run batch generation without reviewing the endpoint, prompt content, and output location.