A guide for creating or changing bitmap images, such as photos, illustrations, textures, mockups, and cut-out images with transparent backgrounds. It defines when to use the built-in image generator and when a command-line fallback is appropriate.

Use it when a project needs a new raster image, an edited image, or visual variants based on references. It covers generation, editing, batch generation, and transparent-background requests.

It gives image-related work a defined process and keeps ordinary generation or editing separate from special command-line cases. It also explains the required setup for the fallback path.

imagegen — Skill for Codex by deonmenezes/mantishack

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add deonmenezes/mantishack --skill imagegen

Clone the repo

git clone --depth 1 https://github.com/deonmenezes/mantishack

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/deonmenezes/mantishack/imagegen/github.svg)](https://agentmods.dev/skills/deonmenezes/mantishack/imagegen)

Your own site

<a href="https://agentmods.dev/skills/deonmenezes/mantishack/imagegen"><img src="https://agentmods.dev/badge/skills/deonmenezes/mantishack/imagegen/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/deonmenezes/mantishack/imagegen"><img src="https://agentmods.dev/badge/skills/deonmenezes/mantishack/imagegen.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 113 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 5,264 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin 86% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00113	$0.05264
Opus 5.5	$0.00045	$0.02106
Sonnet 5.5	$0.00023	$0.01053
Haiku 4.5	$0.00011	$0.00526

Measured 1mo ago against content hash 59981d235192, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

imagegen scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/image_gen.py, scripts/remove_chroma_key.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

86% identical to imagegen — 67 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

codex-rs/skills/src/assets/samples/imagegen/SKILL.md · 357 lines

How it starts

The opening of the file, as written. The whole thing — 357 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Image Generation Skill

Generates or edits images for the current project (for example website assets, game assets, UI mockups, product mockups, wireframes, logo design, photorealistic images, or infographics).

Top-level modes and rules

This skill has exactly two top-level modes:

Default built-in tool mode (preferred): built-in image_gen tool for normal image generation, editing, and simple transparent-image requests. Does not require OPENAI_API_KEY.
Fallback CLI mode: scripts/image_gen.py CLI. Use when the user explicitly asks for the CLI/API/model path, or after the user explicitly confirms a true model-native transparency fallback with gpt-image-1.5. Requires OPENAI_API_KEY.

Within CLI fallback, the CLI exposes three subcommands:

generate
edit
generate-batch

Rules:

Use the built-in image_gen tool by default for normal image generation and editing requests.
Do not switch to CLI fallback for ordinary quality, size, or file-path control.
If the user explicitly asks for a transparent image/background, stay on built-in image_gen first: prompt for a flat removable chroma-key background, then remove it locally with the installed helper at $CODEX_HOME/skills/.system/imagegen/scripts/remove_chroma_key.py.
Never silently switch from built-in image_gen or CLI gpt-image-2 to CLI gpt-image-1.5. Treat this as a model/path downgrade and ask the user before doing it, unless the user has already explicitly requested gpt-image-1.5, scripts/image_gen.py, or CLI fallback.
If a transparent request appears too complex for clean chroma-key removal, asks for true/native transparency, or local removal fails validation, explain that true transparency requires CLI gpt-image-1.5 --background transparent --output-format png because gpt-image-2 does not support background=transparent, then ask whether to proceed. Run the CLI fallback only after the user confirms.
The word batch by itself does not mean CLI fallback. If the user asks for many assets or says to batch-generate assets without explicitly asking for CLI/API/model controls, stay on the built-in path and issue one built-in call per requested asset or variant.
If the built-in tool fails or is unavailable, tell the user the CLI fallback exists and that it requires OPENAI_API_KEY. Proceed only if the user explicitly asks for that fallback.
If the user explicitly asks for CLI mode, use the bundled scripts/image_gen.py workflow. Do not create one-off SDK runners.
Never modify scripts/image_gen.py. If something is missing, ask the user before doing anything else.

Read the full file on GitHub · 357 lines

Files

What ships with it

11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 357 lines · 113 tokens per session scan A 59981d235192

Subscribe to this mod's changes

imagegen is a skill published in the GitHub repository deonmenezes/mantishack (504 stars, last pushed 18d ago), licensed Apache-2.0. It adds 113 tokens to every session and 5,264 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 86% identical to imagegen, differing in 67 lines, and is treated as a copy.

Autonomous Agents Claude Code Creative and media agent-harness ai-agents bug-bounty mcp

graph-db-writes

Writing to the Neo4j attack-surface graph in RedAmon: the tenant-isolation MERGE key every entity node must carry, where graph methods live (mixins, not the client), and the schema places that must be updated together. A MERGE missing the tenant key silently merges one project's data into another's. Trigger: editing…

samugit83/redamon · 119 tokens

project-settings-cascade

Changing or adding a project setting / default value in RedAmon. A single setting is duplicated across Prisma, two separate Python settings modules, the orchestrator defaults endpoint, and the frontend fallback; miss a layer and the UI shows one value while the backend uses another, and existing projects keep the old…

samugit83/redamon · 142 tokens

recon-ai-enrichment

Wiring an LLM into a recon tool's decisions ("let AI pick {feature} for {tool}"): the never-raise contract, the per-target cache, the full+partial coverage, and the two UI toggles bound to one field. A raising AI helper or an empty fallback silently breaks or disables a live scan. Trigger: adding or editing a recon AI…

samugit83/redamon · 188 tokens

plugin-platform

The plugin platform, always on: third-party plugin code runs isolated in the plugin runner, reaches RedAmon only through the Gateway, and changes agent behaviour only through text a person approved in core UI. The base repository holds no plugin logic, and a host that cannot run the platform is refused, never…

samugit83/redamon · 172 tokens

builtin-agent-skill

Adding a built-in Agent Skill (an attack technique like ssrf, xxe, rce) that ships hardcoded in RedAmon: classified by the Intent Router, injected into the agent prompt, toggled per project, badged in the chat drawer. Ten layers across agentic and webapp, two of which fail with no error. Trigger: adding or editing a…

samugit83/redamon · 158 tokens

orchestrator-container-spawn

Spawning and hardening scan containers from the recon orchestrator: the security flags that look correct and break the container, and the sibling bind-mount path handling. capdrop and no-new-privileges were each reverted after breaking real scans. Trigger: editing reconorchestrator/containermanager.py; changing how a…

samugit83/redamon · 103 tokens