Borrowing it
Nothing to install: this file belongs to alecs5am/ralphy. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/alecs5am/ralphy/main/.agents/skills/json-prompt-engine/SKILL.mdgit clone --depth 1 https://github.com/alecs5am/ralphyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alecs5am/ralphy/json-prompt-engine)<a href="https://agentmods.dev/skills/alecs5am/ralphy/json-prompt-engine"><img src="https://agentmods.dev/badge/skills/alecs5am/ralphy/json-prompt-engine/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alecs5am/ralphy/json-prompt-engine"><img src="https://agentmods.dev/badge/skills/alecs5am/ralphy/json-prompt-engine.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 17 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 184 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00270 | $0.03810 |
| Opus 5.5 | $0.00108 | $0.01524 |
| Sonnet 5.5 | $0.00054 | $0.00762 |
| Haiku 4.5 | $0.00027 | $0.00381 |
Grade A, and why
json-prompt-engine scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Route through `ralphy generate image --prompt-file <path>`.** Never paste raw provider API code, never `curl` openrouter, never call a model SDK directly (AGENTS.md invariant #1/#2). The JSON you emit is the *prompt How it starts
The opening of the file, as written. The whole thing — 185 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Trigger
FIRES when the user has a reference (an uploaded image, a local path, a frame pulled from a video) and wants the prompt that would reproduce it: "give me a JSON prompt for this", "image-to-prompt", "reverse-engineer this image", "recreate this look", "describe this in structured prompt format", "what prompt makes this", "turn this reference into a prompt", "per-slide prompts for this carousel style".
DO NOT FIRE when:
- The user asks a conversational visual question — "what is in this image", "is this photoshopped" — that is plain vision, not a prompt request.
- The user wants to edit an existing image (inpaint, swap, restyle) -> that is an
iteration-editgeneration, route to the art-director playbook. - The user already has a written brief and just wants assets generated ->
.agents/skills/art-director/SKILL.mddrives that; this skill is only for the image -> prompt direction. - The user points at a video URL for style analysis across the whole clip -> use
ralphy ref analyze-video(memory:feedback_ralphy_ref_analyze_video) or the/researcherskill, then optionally come back here to emit the JSON for one extracted frame.
What this skill is
The inverse of docs/prompts/image/ (the mode-by-mode prompt cookbook). The cookbook takes a brief and fills slots; this skill takes a finished image and recovers the dense prompt that would regenerate it. The output is one valid JSON object per reference, written to .ralphy/workspaces/<ws>/projects/<id>/prompts/<slot>.json and fed to ralphy generate image --prompt-file. It is a craft overlay on the art-director step, not a replacement for it.
Hard invariants
- Route through
ralphy generate image --prompt-file <path>. Never paste raw provider API code, nevercurlopenrouter, never call a model SDK directly (AGENTS.md invariant #1/#2). The JSON you emit is the prompt body — JSON-structured prompts are an established ralphy pattern (the carousel and fb-creatives skills use the same STYLE + QUALITY block shape). - Read
MODELS.mdbefore naming any model id. The stack below is the default as of 2026-05-20, not a hardcode. Default image model:google/gemini-3-pro-image-preview(multi-ref consistency). Premium typography / legible-label work:openai/gpt-5.4-image-2. Match the model to thequalityprofile you write (see Cookbook). - Reference-required gate still fires. If the recovered prompt names a real person, a recognizable branded product, or an IP (AGENTS.md invariant #3), the source image itself is the ref — pass it on the generate call with
--ref <path>. If the user only wants the JSON text and no generation, that is fine; the gate fires when they ask to generate. - Fold in the matching guideline. If the reference sits in a register the guideline library covers (photoreal humans, broadcast realism, anti-AI-slop), run
ralphy guideline show <slug>and merge itsavoidcluster and required tokens into the JSONqualityblock before handing the prompt off (AGENTS.md invariant #13). Thequality.avoidarray is exactly where the anti-AI-slop negative cluster belongs. - Quality gate refuses, not warns. When you do generate, two failed
scoreImagein a row -> stop and report concrete options. Do not keep re-rolling silently. - English only on disk. Every JSON value you write to a
prompts/*.jsonfile is English, even if the user is chatting in another language.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 185 lines · 270 tokens per session scan A 540d0b7a495a
json-prompt-engine is a skill published in the GitHub repository alecs5am/ralphy (140 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 270 tokens to every session and 3,810 once invoked, about $0.0011 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
seedance-2-5-prompt-director
A skill for writing and improving prompts for Seedance 2.5, a video-generation system. It covers text-to-video, image-to-video, editing, video extension, references, camera movement, green-screen work, sound, and lip sync.
post-training-strategy
A guide to choosing and planning ways to improve an AI model after its initial training. It explains when to add knowledge, teach a response format, use trial-and-error training, or use a smaller model to learn from a larger one.
agent-evolution
A guide to making an AI agent improve from its past runs. It covers how to judge results, extract reusable lessons, and decide whether to store them as knowledge, instructions, code, or model training.
llm-redteam-overview
LLM red team category — full AATMF v3 tactic coverage (T01–T15). Routing skill: read this first to identify which tactic applies, then load the matching sub-skill. Maps to MITRE ATLAS where overlap exists.
pyhealth
Comprehensive healthcare AI toolkit for developing, testing, and deploying machine learning models with clinical data. This skill should be used when working with electronic health records (EHR), clinical prediction tasks (mortality, readmission, drug recommendation), medical coding systems (ICD, NDC, ATC)…
deepchem
Molecular ML with diverse featurizers and pre-built datasets. Use for property prediction (ADMET, toxicity) with traditional ML or GNNs when you want extensive featurization options and MoleculeNet benchmarks. Best for quick experiments with pre-trained models, diverse molecular representations. For graph-first…