技能 gpt-image-edit
📦
gpt-image-edit
内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
在 RunComfy 上使用 GPT Image 2 编辑图像
定向图像编辑经常会出现偏移，尤其是在人物面孔、品牌和文字方面。此技能提供用于 GPT Image 2 编辑的 RunComfy CLI 模式，并配有侧重保持原样的提示词。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "gpt-image-edit" from https://skillstore.io/skills/doany-ai-gpt-image-edit.md and its manifest at https://skillstore.io/api/skills/doany-ai-gpt-image-edit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“gpt-image-edit”。 一张肖像需要中性的影棚背景，且不能改变人物。
预期结果:
一个可直接用于命令的编辑提示词，优先保持面孔、姿势、服装不变，并替换背景。
正在使用“gpt-image-edit”。 一张海报标题必须改写为日语，同时保持原始布局。
预期结果:
一个引用日语文本并将编辑范围限制在标题区域的提示词。
正在使用“gpt-image-edit”。 一个产品应被放入第二张参考图像中的房间。
预期结果:
一个多参考提示词，将 image 1 标识为主体，将 image 2 标识为场景。
安全审计
高风险v4 • 2026/7/5 打开版本化报告
Most static backtick and path traversal alerts are Markdown formatting or placeholder URLs rather than executable code. Confirmed risks are the intended use of the RunComfy CLI, third-party network processing, and a source mismatch that points users to another repository. No prompt injection attempt was found in SKILL.md.
1
已扫描文件
184
分析行数
13
复核项
0
已忽略误报
已确认安全问题 (2)
高
Install Source Mismatch
SKILL.md links and install instructions point to agentspace-so/runcomfy-skills while this audit targets doany-ai/gpt-image-edit. Users could install a different repository than the reviewed package.
The GitHub link and install command both name agentspace-so/runcomfy-skills. The audited source metadata names doany-ai, so the mismatch is direct and reproducible.
中
Third-Party Image Processing Boundary
The skill sends prompts to model-api.runcomfy.net and says image URLs are fetched by the RunComfy model server. This exposes prompts, image URLs, and generated outputs to a third-party service.
The file explicitly describes the outbound model API call and remote fetching of image URLs. This is expected functionality, but it is a clear privacy boundary.
能力复核项 (13)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Ruby/shell backtick execution
`runcomfy run openai/gpt-image-2/edit` through the local RunComfy CLI.
Line 13 states the skill calls the local RunComfy CLI. That is intended functionality, but it executes a third-party command from the user environment.
中
Ruby/shell backtick execution
```bash
The code block contains an npx skills install command from a GitHub repository. If followed, it triggers package and repository installation outside the skill content itself.
中
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
Line 45 instructs users to globally install the RunComfy CLI with npm. Global package installation is a real supply-chain and local execution risk.
中
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
Line 46 instructs users to run RunComfy login, which starts an authentication flow. This is expected, but it is still external command execution involving credentials.
中
Ruby/shell backtick execution
```bash
The command block runs runcomfy with user image input and an output directory. It is legitimate for this skill, but it is a concrete external command invocation.
中
Ruby/shell backtick execution
```bash
The command block runs runcomfy for a multilingual edit and sends image input to the service. It is a real external command, even though the example is documented.
中
Ruby/shell backtick execution
```bash
The command block runs runcomfy for a multi-reference edit with external image URLs. This is intended, but it is still external command execution.
中
Ruby/shell backtick execution
The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The C
Line 175 explicitly states that the skill invokes runcomfy run and downloads generated outputs. This confirms the external command behavior described by the skill.
中
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
Line 179 refers to running RunComfy login and writing an API token. The command is expected, but it handles credentials on the local machine.
低
Hardcoded URL
"images": ["https://.../portrait.jpg"]
The example image URL is a placeholder, not a fixed malicious endpoint. It still demonstrates that user image URLs are supplied to a remote model service.
低
Hardcoded URL
"images": ["https://.../poster-en.jpg"]
The example poster URL is a placeholder, but it documents remote image input for the model request. This is an expected low-severity network privacy consideration.
低
Hardcoded URL
"images": ["https://.../subject.jpg", "https://.../room.jpg"]
The multi-reference example uses placeholder HTTPS image URLs. The endpoint is not hardcoded here, but the example confirms remote image references are part of use.
低
Hardcoded URL
The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The C
Line 175 names the RunComfy model API endpoint and output download domains. This is a real outbound network dependency for prompts, image URLs, and generated outputs.
风险因素
⚙️ 外部命令 (38)
SKILL.md:5 SKILL.md:13 SKILL.md:24 SKILL.md:26-28 SKILL.md:28-40 SKILL.md:40-45 SKILL.md:45-46 SKILL.md:46-47 SKILL.md:47 SKILL.md:51-55 SKILL.md:55-56 SKILL.md:56-57 SKILL.md:57 SKILL.md:59-65 SKILL.md:65-72 SKILL.md:72-76 SKILL.md:76-83 SKILL.md:83-87 SKILL.md:87-94 SKILL.md:94-98 SKILL.md:98-100 SKILL.md:100 SKILL.md:102 SKILL.md:104 SKILL.md:106-112 SKILL.md:112 SKILL.md:128-133 SKILL.md:133-137 SKILL.md:137-142 SKILL.md:142-146 SKILL.md:146-150 SKILL.md:150-154 SKILL.md:154 SKILL.md:155-175 SKILL.md:175 SKILL.md:179 SKILL.md:180-182 SKILL.md:182
📁 文件系统访问 (6)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/doany-ai-gpt-image-edit/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/doany-ai-gpt-image-edit?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/doany-ai-gpt-image-edit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/doany-ai-gpt-image-edit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/doany-ai-gpt-image-edit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
doany-ai. (2026). gpt-image-edit security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/doany-ai-gpt-image-edit/audits/4BibTeX 引用
@techreport{doany-ai-doany-ai-gpt-image-edit-2026,
author = {doany-ai},
title = {gpt-image-edit security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/doany-ai-gpt-image-edit/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gpt-image-edit security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "doany-ai"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/doany-ai-gpt-image-edit/audits/4"
identifiers:
- type: other
value: "skillstore:doany-ai-gpt-image-edit:audit:4"
description: "Skillstore immutable audit report identifier"
比较变体
3 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
Skillstore 评分最高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
runcomfy-com 推荐
runcomfy-com-gpt-image-edit
Skillstore 评分 70
证据置信度 高
Skillstore 使用量 43
已更新
2026-09-09
agentspace-so-gpt-image-edit
Skillstore 评分 50
证据置信度 高
Skillstore 使用量 11
已更新
2026-09-09
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
85
内容
67
社区
83
规范符合性
你能构建什么
本地化广告创意
将图像标题替换为另一种语言，同时保持布局、产品位置和品牌标识不变。
准备产品变体
更改产品图像的背景或文字，同时保持主体产品稳定不变。
组合参考图像
将一张图像中的主体与其他参考图像中的场景或配色组合起来。
试试这些提示
初级背景替换
Keep the main subject, pose, clothing, and brand marks unchanged. Replace only the background with a clean studio setting.
本地化标题编辑
Keep the photo, layout, lighting, and logo unchanged. Replace only the headline with "Your translated text" in the same position.
多参考组合
Use the subject from image 1 and the room style from image 2. Match lighting and preserve subject identity.
精确布局修改
Keep the product and brand assets unchanged. Move the headline to the bottom center, update the CTA text, and preserve spacing.
最佳实践
- 先说明保持原样的要求，再说明请求的更改。
- 引用准确的图中文字，并说明文字体系或语言。
- 除非编辑需要新的宽高比，否则使用 size auto。
避免
- 将许多无关的编辑合并到一个很长的提示词中。
- 使用模糊指令，例如 make it better 或 improve the image。
- 未经批准通过公共 URL 传递私有图像。
常见问题
此技能会从零开始生成图像吗？
不是。它专注于通过 GPT Image 2 edit 端点编辑现有图像。
它支持哪些工具？
它标记为兼容 Claude、Codex 和 Claude Code。
我需要 RunComfy 账户吗？
需要。该工作流要求先完成 RunComfy CLI 和身份验证，然后模型调用才能工作。
它可以编辑图像中的文字吗？
可以。说明强调引用准确的替换文本，并保持周围布局不变。
我可以使用多少张参考图像？
该技能文档说明，一次编辑请求最多可使用十个公共 HTTPS 图像 URL。
图像在哪里处理？
提示词和图像 URL 会发送到 RunComfy model API 端点进行处理。