技能 gpt-image-edit
📦
gpt-image-edit
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取
在 RunComfy 上使用 GPT Image 2 編輯圖片
定向圖片編輯經常會偏離目標，尤其是涉及臉部、品牌和文字時。此 skill 提供用於 GPT Image 2 編輯的 RunComfy CLI 模式，並搭配注重保留原貌的提示詞。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "gpt-image-edit" from https://skillstore.io/skills/doany-ai-gpt-image-edit.md and its manifest at https://skillstore.io/api/skills/doany-ai-gpt-image-edit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「gpt-image-edit」。 一張肖像需要中性的攝影棚背景，且不能改變人物。
預期結果:
一個可直接用於命令的編輯提示詞，優先保留臉部、姿勢、服裝，並替換背景。
正在使用「gpt-image-edit」。 一張海報標題必須改寫成日文，同時保留原始版面。
預期結果:
一個引用日文文字，並將編輯限制在標題區域的提示詞。
正在使用「gpt-image-edit」。 一個產品應放入第二張參考圖片中的房間。
預期結果:
一個多參考提示詞，將 image 1 指定為主體，將 image 2 指定為場景。
安全審計
高風險v4 • 2026/7/5 開啟版本化報告
Most static backtick and path traversal alerts are Markdown formatting or placeholder URLs rather than executable code. Confirmed risks are the intended use of the RunComfy CLI, third-party network processing, and a source mismatch that points users to another repository. No prompt injection attempt was found in SKILL.md.
1
已掃描檔案
184
分析行數
13
複核項目
0
已忽略的誤報
已確認的安全問題 (2)
高
Install Source Mismatch
SKILL.md links and install instructions point to agentspace-so/runcomfy-skills while this audit targets doany-ai/gpt-image-edit. Users could install a different repository than the reviewed package.
The GitHub link and install command both name agentspace-so/runcomfy-skills. The audited source metadata names doany-ai, so the mismatch is direct and reproducible.
中
Third-Party Image Processing Boundary
The skill sends prompts to model-api.runcomfy.net and says image URLs are fetched by the RunComfy model server. This exposes prompts, image URLs, and generated outputs to a third-party service.
The file explicitly describes the outbound model API call and remote fetching of image URLs. This is expected functionality, but it is a clear privacy boundary.
能力複核項目 (13)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
中
Ruby/shell backtick execution
`runcomfy run openai/gpt-image-2/edit` through the local RunComfy CLI.
Line 13 states the skill calls the local RunComfy CLI. That is intended functionality, but it executes a third-party command from the user environment.
中
Ruby/shell backtick execution
```bash
The code block contains an npx skills install command from a GitHub repository. If followed, it triggers package and repository installation outside the skill content itself.
中
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
Line 45 instructs users to globally install the RunComfy CLI with npm. Global package installation is a real supply-chain and local execution risk.
中
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
Line 46 instructs users to run RunComfy login, which starts an authentication flow. This is expected, but it is still external command execution involving credentials.
中
Ruby/shell backtick execution
```bash
The command block runs runcomfy with user image input and an output directory. It is legitimate for this skill, but it is a concrete external command invocation.
中
Ruby/shell backtick execution
```bash
The command block runs runcomfy for a multilingual edit and sends image input to the service. It is a real external command, even though the example is documented.
中
Ruby/shell backtick execution
```bash
The command block runs runcomfy for a multi-reference edit with external image URLs. This is intended, but it is still external command execution.
中
Ruby/shell backtick execution
The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The C
Line 175 explicitly states that the skill invokes runcomfy run and downloads generated outputs. This confirms the external command behavior described by the skill.
中
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
Line 179 refers to running RunComfy login and writing an API token. The command is expected, but it handles credentials on the local machine.
低
Hardcoded URL
"images": ["https://.../portrait.jpg"]
The example image URL is a placeholder, not a fixed malicious endpoint. It still demonstrates that user image URLs are supplied to a remote model service.
低
Hardcoded URL
"images": ["https://.../poster-en.jpg"]
The example poster URL is a placeholder, but it documents remote image input for the model request. This is an expected low-severity network privacy consideration.
低
Hardcoded URL
"images": ["https://.../subject.jpg", "https://.../room.jpg"]
The multi-reference example uses placeholder HTTPS image URLs. The endpoint is not hardcoded here, but the example confirms remote image references are part of use.
低
Hardcoded URL
The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The C
Line 175 names the RunComfy model API endpoint and output download domains. This is a real outbound network dependency for prompts, image URLs, and generated outputs.
風險因素
⚙️ 外部命令 (38)
SKILL.md:5 SKILL.md:13 SKILL.md:24 SKILL.md:26-28 SKILL.md:28-40 SKILL.md:40-45 SKILL.md:45-46 SKILL.md:46-47 SKILL.md:47 SKILL.md:51-55 SKILL.md:55-56 SKILL.md:56-57 SKILL.md:57 SKILL.md:59-65 SKILL.md:65-72 SKILL.md:72-76 SKILL.md:76-83 SKILL.md:83-87 SKILL.md:87-94 SKILL.md:94-98 SKILL.md:98-100 SKILL.md:100 SKILL.md:102 SKILL.md:104 SKILL.md:106-112 SKILL.md:112 SKILL.md:128-133 SKILL.md:133-137 SKILL.md:137-142 SKILL.md:142-146 SKILL.md:146-150 SKILL.md:150-154 SKILL.md:154 SKILL.md:155-175 SKILL.md:175 SKILL.md:179 SKILL.md:180-182 SKILL.md:182
📁 檔案系統存取 (6)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/doany-ai-gpt-image-edit/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/doany-ai-gpt-image-edit?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/doany-ai-gpt-image-edit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/doany-ai-gpt-image-edit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/doany-ai-gpt-image-edit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
doany-ai. (2026). gpt-image-edit security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/doany-ai-gpt-image-edit/audits/4BibTeX 引用
@techreport{doany-ai-doany-ai-gpt-image-edit-2026,
author = {doany-ai},
title = {gpt-image-edit security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/doany-ai-gpt-image-edit/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gpt-image-edit security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "doany-ai"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/doany-ai-gpt-image-edit/audits/4"
identifiers:
- type: other
value: "skillstore:doany-ai-gpt-image-edit:audit:4"
description: "Skillstore immutable audit report identifier"
比較變體
4 個可安裝變體每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。
為何此變體排名第一
Skillstore 評分最高
作者 / 來源 Skillstore 評分 證據置信度 Skillstore 使用量 已更新
prime-skills 推薦
prime-skills-gpt-image-edit
Skillstore 評分 77
證據置信度 中
Skillstore 使用量 3
已更新
2026-10-24
agentspace-so-gpt-image-edit
Skillstore 評分 50
證據置信度 高
Skillstore 使用量 15
已更新
2026-10-22
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
85
內容
67
社群
83
規範符合度
你可以打造什麼
在地化廣告素材
將圖片標題替換成另一種語言，同時保留版面、產品位置和品牌標誌。
準備產品變體
變更產品圖片的背景或文字，同時保持主要產品穩定不變。
合成參考圖片
將一張圖片中的主體與其他參考圖片中的場景或調色盤結合。
試試這些提示
初學者背景替換
Keep the main subject, pose, clothing, and brand marks unchanged. Replace only the background with a clean studio setting.
在地化標題編輯
Keep the photo, layout, lighting, and logo unchanged. Replace only the headline with "Your translated text" in the same position.
多參考合成
Use the subject from image 1 and the room style from image 2. Match lighting and preserve subject identity.
精準版面修訂
Keep the product and brand assets unchanged. Move the headline to the bottom center, update the CTA text, and preserve spacing.
最佳實務
- 先說明保留要求，再提出所需變更。
- 引用精確的圖片內文字，並指明文字系統或語言。
- 除非編輯需要新的長寬比，否則使用 size auto。
避免
- 將許多不相關的編輯合併成一個冗長提示詞。
- 使用模糊指令，例如 make it better 或 improve the image。
- 未經核准就透過公開 URLs 傳送私人圖片。
常見問題
此 skill 會從零生成圖片嗎？
不會。它著重於透過 GPT Image 2 edit endpoint 編輯既有圖片。
它支援哪些工具？
它標示為相容於 Claude、Codex 和 Claude Code。
我需要 RunComfy 帳戶嗎？
需要。此工作流程需要 RunComfy CLI，並且必須先完成驗證，model calls 才能運作。
它可以編輯圖片中的文字嗎？
可以。指令強調要引用精確的替換文字，並保留周圍版面。
我可以使用多少張參考圖片？
此 skill 記錄單次編輯請求最多可使用十個公開 HTTPS image URLs。
圖片會在哪裡處理？
提示詞和圖片 URLs 會傳送到 RunComfy model API endpoints 進行處理。