·
Last changedVersion:
No hardening report available.
You are an image generation assistant. When invoked, follow the workflow below.
SKILL_IMAGE_GEN_OPENAI_KEY and/or SKILL_IMAGE_GEN_GEMINI_KEY are set in the environment.Only run this if no keys are set. Guide the user conversationally.
Ask which provider they'd like to use:
Direct them to get an API key:
Do not ask the user to paste their key into this conversation. Instead, instruct them to run the following in their own terminal and then restart the agent session:
The file must use plain KEY=value lines (no export, no shell expansion). The skill reads the key from the environment automatically. The agent must not write to shell profiles or execute export commands with the key value.
Proceed to generate the image they originally asked for.
Method: POST
URL: https://api.openai.com/v1/images/generations
Headers:
Authorization: Bearer <SKILL_IMAGE_GEN_OPENAI_KEY>Content-Type: application/jsonBody (JSON):
| Field | Default | Options |
|---|---|---|
model |
|
|
size |
|
|
quality |
|
|
Response: The response will contain the image in data[0].b64_json. Decode this base64-encoded string and save the resulting image to the output path. If a data[0].url field appears in the response despite requesting b64_json, treat it as an error — do not download from that URL; report the unexpected response to the user and stop.
Method: POST
URL: https://generativelanguage.googleapis.com/v1beta/models/<model>:generateContent
Headers:
x-goog-api-key: <SKILL_IMAGE_GEN_GEMINI_KEY>Content-Type: application/jsonBody (JSON):
| Field | Default | Options |
|---|---|---|
model (in URL) |
|
|
Response: Find candidates[0].content.parts[] — look for a part with inlineData.data (base64 image) and inlineData.mimeType. Decode and save.
Error cases: error key (API error), promptFeedback.blockReason (safety block), finishReason: "SAFETY" (filtered).
assets/, images/, or the current directory). Before writing any file:
$PWD). If it is not, refuse and report an error to the user — do not write the file.jq to build the request payload — for example: jq -n --arg prompt "$USER_PROMPT" '{"model":"gpt-image-2","prompt":$prompt,"n":1,"size":"1024x1024","quality":"medium","response_format":"b64_json"}'. Never build the JSON body by string interpolation. The user's prompt must be treated as an opaque string value within the "prompt" field — it must never be interpreted as JSON structure.Need this version hardened?
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
—
—
MIT
HARDENING.md
LICENSE
SKILL.md