技能 image-generation
📦
image-generation
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取
使用 Agent 提示生成託管圖片
Agent 需要可靠的圖片生成能力，而不必進行本機設定或使用供應商金鑰。此技能會引導 Claude、Codex 和 Claude Code 完成託管 Image Skill CLI 與 API 工作流程。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "image-generation" from https://skillstore.io/skills/danielgwilson-image-generation.md and its manifest at https://skillstore.io/api/skills/danielgwilson-image-generation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「image-generation」。 生成一張不鏽鋼工作檯上有一台小型野外相機的概念圖片。
預期結果:
託管媒體連結、模型名稱、提示摘要、成本收據，以及可復原的工作參照。
正在使用「image-generation」。 檢查圖片生成是否已就緒，且不要花費任何費用。
預期結果:
就緒狀態、任何缺少的輸入，以及建議的零花費下一步。
正在使用「image-generation」。 復原上一個產品圖片工作，並讓它更明亮。
預期結果:
復原的媒體連結、先前的提示摘要、修訂後的提示方向，以及新的託管輸出詳細資訊。
安全審計
高風險v4 • 2026/7/5 開啟版本化報告
The skill is not a prompt-injection attempt, but it relies on external hosted services and several shell workflows. Real risks include npx execution of remote packages, global skill installation, remote-supplied next commands, hidden agent-state paths, and paid media generation.
1
已掃描檔案
79
分析行數
12
複核項目
0
已忽略的誤報
已確認的安全問題 (2)
高
Remote Command Delegation
The skill tells agents to run data.next_command returned by the hosted guide when data.next_command_copy_runnable is true. This lets a remote service influence shell commands an agent executes.
The instruction is explicit on line 28 and is separate from the static backtick pattern. The guard flag reduces accidental use but does not remove remote command influence.
中
Automated Paid Media Spend Workflow
The skill allows image creation when media spend is allowed and provides a maximum estimated cost per image. Ambiguous approval could let an agent trigger paid generation unexpectedly.
The skill includes spend gating language and a cost limit flag, so the monetary workflow is real. The risk depends on how the host enforces user approval.
能力複核項目 (12)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Ruby/shell backtick execution
```bash
The command block at lines 46-48 installs a community skill globally for Codex with -g and -y. This can modify agent behavior without an interactive confirmation step.
高
Ruby/shell backtick execution
```bash
The command block at lines 52-54 installs the canonical image-skill globally with automatic yes flags. A global skill install can alter future agent behavior and should require trust review.
中
Ruby/shell backtick execution
Do not bring provider API keys, create provider accounts, run a local model server, or wire a separa
Line 28 instructs agents to run data.next_command returned by the hosted guide when a flag is true. That delegates command execution to remote service output, which is a real execution risk.
中
Ruby/shell backtick execution
```bash
The fenced bash block at lines 32-34 contains an npx command that downloads and runs image-skill@latest. Running an unpinned remote package can execute arbitrary package code.
中
Ruby/shell backtick execution
```bash
The bash block at lines 38-40 runs npx image-skill@latest with a prompt and cost parameter. It executes remote package code and sends generation requests to the hosted runtime.
中
Ruby/shell backtick execution
```bash
The bash block at lines 62-67 changes HOME and CODEX_HOME, creates directories, and runs a global skill install. These are real shell operations affecting agent state.
中
Ruby/shell backtick execution
```
The range includes an instruction on line 78 to run image-skill feedback create with attempted command details. It is a legitimate support workflow, but it still invokes an external CLI and can transmit operational data.
中
Hidden file access
`$HOME/.agents`; `CODEX_HOME` keeps Codex profile state on the same writable
Line 59 states that the adapter writes to $HOME/.agents and uses CODEX_HOME for profile state. Hidden agent-state paths can affect future agent behavior and should be explicit.
中
Hidden file access
export HOME="$PWD/.agent-home"
Line 63 redirects HOME to a hidden workspace directory. This changes where tools read and write user state, which is a meaningful filesystem side effect.
中
Hidden file access
export CODEX_HOME="$HOME/.codex"
Line 64 redirects CODEX_HOME into $HOME/.codex. That changes Codex profile state storage and can influence later agent sessions.
低
Hardcoded URL
canonical_api_url: https://api.image-skill.com
The skill declares https://api.image-skill.com as the canonical API endpoint. Image prompts, job metadata, and media requests may be sent to this third-party hosted service.
低
Hardcoded URL
- Hosted API: https://api.image-skill.com
Line 76 identifies the hosted API endpoint used by the workflow. Calls to that service can expose prompts, job details, and media metadata to the provider.
風險因素
⚙️ 外部命令 (13)
🌐 網路存取 (8)
📁 檔案系統存取 (3)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/danielgwilson-image-generation/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/danielgwilson-image-generation?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/danielgwilson-image-generation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/danielgwilson-image-generation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/danielgwilson-image-generation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
danielgwilson. (2026). image-generation security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/danielgwilson-image-generation/audits/4BibTeX 引用
@techreport{danielgwilson-danielgwilson-image-generation-2026,
author = {danielgwilson},
title = {image-generation security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/danielgwilson-image-generation/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "image-generation security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "danielgwilson"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/danielgwilson-image-generation/audits/4"
identifiers:
- type: other
value: "skillstore:danielgwilson-image-generation:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
67
社群
83
規範符合度
你可以打造什麼
建立產品概念圖片
從產品提示生成託管視覺概念，並提供模型設定與成本收據以供檢閱。
將圖片輸出加入 Agent 工作流程
使用可重複執行的 CLI 指令，讓 agent 在專案工作期間建立、復原並引用生成的媒體。
快速草擬行銷活動視覺素材
不必設定個別供應商帳戶或本機模型伺服器，即可建立插圖或產品圖片草稿。
試試這些提示
建立簡單圖片
Use the image-generation skill to create a hosted image of [subject] in [style]. Keep spend under [amount] and return the image URL and receipt.
探索風格選項
Generate three prompt variations for [product or scene]. Use guide mode first, then create the best option only after I approve spend.
製作產品視覺素材
Create hosted product images for [product]. Use [model], [aspect ratio], and [budget], then summarize URLs, costs, and prompts.
復原並改進工作
Find the previous Image Skill job for [project], recover the hosted media, create an improved version with [changes], and record feedback if a capability is missing.
最佳實務
- 先執行 guide mode，並且只在明確核准花費後才建立圖片。
- 執行前先檢閱遠端指令，尤其是 npx 和 data.next_command。
- 將提示、工作識別碼、URL 和收據保存在專案記錄中。
避免
- 不要將機密或供應商 API 金鑰貼到提示或指令引數中。
- 不要在未閱讀並核准的情況下執行遠端提供的指令。
- 不要假設生成的媒體是私密的或可離線使用。
常見問題
這需要供應商 API 金鑰嗎？
不需要。此技能圍繞託管 Image Skill 執行環境設計，而不是直接使用供應商憑證。
它可以離線運作嗎？
不能。它需要網路存取託管 Image Skill 服務和 npm 套件來源。
哪些 AI 工具可以使用它？
報告列出 Claude、Codex 和 Claude Code 為支援的工具。
圖片生成會產生費用嗎？
會。工作流程包含花費核准用語和預估成本參數。
生成的圖片儲存在哪裡？
此技能描述由 Image Skill 服務管理的持久託管媒體 URL。
安裝前我應該檢閱什麼？
請檢閱 npx 指令、全域安裝旗標、外部 API 端點，以及 HOME 或 CODEX_HOME 路徑變更。
開發者詳細資訊
授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
7e9e368dc1a370f2040369ebcd0db06d90cb48e5
維護新鮮度
2026/7/18
使用量
1 次下載 · 0 次瀏覽
檔案結構
📄 SKILL.md