Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add evanca/flutter-ai-rules --skill generate-images-with-firebase-aigit clone --depth 1 https://github.com/evanca/flutter-ai-rulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evanca/flutter-ai-rules/generate-images-with-firebase-ai)<a href="https://agentmods.dev/skills/evanca/flutter-ai-rules/generate-images-with-firebase-ai"><img src="https://agentmods.dev/badge/skills/evanca/flutter-ai-rules/generate-images-with-firebase-ai/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/evanca/flutter-ai-rules/generate-images-with-firebase-ai"><img src="https://agentmods.dev/badge/skills/evanca/flutter-ai-rules/generate-images-with-firebase-ai.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 179 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.02125 |
| Opus 5 | $0.00042 | $0.01063 |
| Sonnet 5 | $0.00017 | $0.00425 |
| Haiku 4.5 | $0.00008 | $0.00213 |
Grade A, and why
generate-images-with-firebase-ai scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Generating images with Firebase AI Logic
Gemini image models return interleaved text and image parts from one call. The response is a sequence to walk, not a string to read.
A request that comes back empty is usually a configuration problem rather than a bug in your code, so section 1 covers the three settings that cause it.
1. Three things that block the very first call
A first call that returns an error, an empty response, or a 403 is almost always one of these rather than your Dart. Rule them out before you debug code.
Billing. Image generation has no free tier. On a Spark-plan project the
image models return limit: 0 for generate_content_free_tier_requests, so
the first request fails on quota having made zero requests. Text models do work
on Spark, which means "my other Gemini call works" proves nothing. Upgrade to
Blaze, then verify the current limits rather than trusting this note:
gcloud services quota list --service=generativelanguage.googleapis.com --consumer=projects/YOUR_PROJECT_ID
App Check. Firebase AI Logic enforces App Check when the project has it
turned on. Otherwise the endpoint is open to anyone who extracts your config
from the shipped client, and that config is public by design. Anything
reachable from a device you do not control needs App Check. Debug builds
attest with a debug provider, release builds with a real one. Web has a
specific trap that costs an afternoon, described in references/setup.md.
responseModalities. Without it the model has no permission to return an
image, so you get text describing the picture it would have drawn. Set both
modalities, as in the call below.
2. The minimal call that works
final model = FirebaseAI.googleAI().generativeModel(
model: 'gemini-3.1-flash-image',
generationConfig: GenerationConfig(
responseModalities: [
ResponseModalities.text,
ResponseModalities.image,
],
imageConfig: ImageConfig(
aspectRatio: ImageAspectRatio.landscape16x9,
imageSize: ImageSize.size2K,
),
),
);
final response = await model.generateContent([
Content.multi([
TextPart(prompt),
InlineDataPart('image/jpeg', selfieBytes), // omit for text-to-image
]),
]);
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 214 lines · 84 tokens per session scan A d09b320b125b
generate-images-with-firebase-ai is a skill published in the GitHub repository evanca/flutter-ai-rules (637 stars, last pushed 12d ago), licensed MIT. It adds 84 tokens to every session and 2,125 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dart-expert
Expert-level Dart, Flutter, mobile development, and cross-platform apps. Use when the user mentions Flutter, mobile, cross platform, or widgets, or when the task involves Dart Language or Flutter Framework.
flutter-sdk-changelog
Expert guide and lookup reference for Flutter framework versions, widget deprecations, API replacements, Material 3 migrations, and the unbundling of standalone materialui and cupertinoui packages from Flutter 1.0 to modern Flutter (3.44+ / 3.47+). Use this skill whenever the user asks "what's new in Flutter X"…
Flutter Testing Patterns
Flutter app testing with widget tests, integration tests, golden tests, Mockito, bloc testing, and Flutter Driver for end-to-end scenarios.
at_client_skills-sdk
Use this skill when a developer is building a Dart or Flutter app that depends on atclient or atclientflutter from pub.dev, stores or shares data via the Atsign Protocol, needs onboarding (CRAM new-atsign, atKeys file, keychain, APKAM) or APKAM enrollment, or asks about AtCollection , CItem , Query , sub-collections…
signals-hooks
Comprehensive reactive state hooks for integration with flutterhooks.
signals-flutter
Highly optimized Flutter UI bindings and GPU rendering for reactive signals.