Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MJorgin/dsh-media-skills --skill media-toolsgit clone --depth 1 https://github.com/MJorgin/dsh-media-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mjorgin/dsh-media-skills/media-tools)<a href="https://agentmods.dev/skills/mjorgin/dsh-media-skills/media-tools"><img src="https://agentmods.dev/badge/skills/mjorgin/dsh-media-skills/media-tools/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mjorgin/dsh-media-skills/media-tools"><img src="https://agentmods.dev/badge/skills/mjorgin/dsh-media-skills/media-tools.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 3 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01225 |
| Opus 5.5 | $0.00033 | $0.00490 |
| Sonnet 5.5 | $0.00017 | $0.00245 |
| Haiku 4.5 | $0.00008 | $0.00122 |
Grade A, and why
media-tools scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Media Tools（图片生成）
通过用户自行配置的服务商生成图片素材。优先使用 SenseNova U1 Fast；未配置 SenseNova key 时，使用 SiliconFlow Kolors。面板里配置的自定义提供方（任意 OpenAI 兼容 /images/generations）也能用。
用法
python3 scripts/generate.py "<提示词>" <输出路径.png> [尺寸]
示例：
python3 scripts/generate.py "云海中的中国宫殿，写实电影感，气势恢宏" palace.jpg 16:9
python3 scripts/generate.py "简洁科技感产品发布会背景，深蓝渐变" banner.png 2752x1536
没有 Key 也能用
Pollinations 不需要注册也不需要 Key（同一 IP 每 45 秒一张，最大 768×768，角落有小 logo）：
MEDIA_API_URL=https://image.pollinations.ai/prompt python3 scripts/generate.py "..." out.png 1:1
密钥边界
Key 只从环境变量、~/.dsh/secrets/media-tools.env（权限 600）或旧的 ~/.codex/secrets/media-tools.env 读取；脚本只把它放进请求头发给用户自己选的服务商，不写日志、不上传、不内置在仓库里。
尺寸
- SenseNova 支持常见横版、竖版和方形比例，可传
16:9、9:16、1:1、3:4、4:3等比例。 - 也可传精确尺寸；脚本会映射到最接近宽高比的 SenseNova 支持尺寸。
- SiliconFlow 会把第三参数作为
image_size传给 Kolors。 - 缺省尺寸为
1024x1024。
选择服务商
脚本默认按 key 是否存在自动挑。要指定服务商，用环境变量（面板里选的服务商和模型，走的就是这几个变量）：
MEDIA_PROVIDER=siliconflow python3 scripts/generate.py "..." out.png 16:9 # 指定内置服务商
MEDIA_MODEL=other-model python3 scripts/generate.py "..." out.png 16:9 # 换模型 ID
# 任意 OpenAI 兼容端点（面板里的「自定义提供方」走的就是这条）
MEDIA_API_URL=https://api.example.com/v1/images/generations \
MEDIA_API_KEY=sk-... MEDIA_MODEL=my-model \
python3 scripts/generate.py "..." out.png 1024x1024
# 免 Key 的 Pollinations（同一 IP 每 45 秒一张，最大 768×768，右下角带它的小 logo）
MEDIA_API_URL=https://image.pollinations.ai/prompt \
python3 scripts/generate.py "..." out.jpg 1024x576
自定义端点不填 MEDIA_API_KEY 时不发 Authorization 头，所以像 Pollinations 这种不需要 Key 的服务也能直接接。
尺寸可以写比例简写（16:9）、精确像素（1024x576），或者不传 —— 不传时由服务商决定画布大小。
自定义端点按 OpenAI 兼容格式发送 {"model","prompt","size","n"}，接受 data[0].url、data[0].b64_json、images[0].url 三种返回。
Cloudflare Workers AI 的地址（.../ai/run/@cf/...）自动换成它自己的请求体 {"prompt","steps"}，并解析 result.image 的 base64 返回。
密钥来源
按顺序读取：
- 进程环境变量；
~/.dsh/secrets/media-tools.env；~/.codex/secrets/media-tools.env（历史兼容）。
支持的 key：
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +38 lines f7a1bba851c4
- 1mo ago Changed · +24 lines · +6 tokens per session c5011d569672
- 2mo ago First seen · 31 lines · 77 tokens per session scan A b283db689f08
media-tools is a skill published in the GitHub repository MJorgin/dsh-media-skills (25 stars, last pushed 3d ago), licensed MIT. It adds 83 tokens to every session and 1,225 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-community-plugins
A guide to finding, checking, installing, updating, and removing community extensions for DeepSeek Harness (dsh), an AI coding-agent framework. It covers plugins distributed through GitHub topics, npm packages, directories, bundles, tarballs, and a graphical interface.
dsh-plugin-schemes
A set of rules for choosing the right kind of DeepSeek Harness extension before building it. It explains the differences between bundles, local patches, agent presets, skills, and temporary runtime plugins.
naval-perspective
A thinking and communication framework based on Naval Ravikant’s public ideas about wealth, work, learning, and leverage. Leverage means using tools such as code, capital, or media so one effort can produce results many times.
feynman-perspective
An AI perspective guide based on Richard Feynman's writings, talks, and life stories. It tests whether an explanation is truly understood by reducing it to simple language, concrete examples, and checks that could prove it wrong.
x-mastery-mentor
An X/Twitter content and growth mentor for AI and technology creators. It provides frameworks for choosing topics, writing posts and threads, reviewing content, and understanding platform algorithms.
elon-musk-perspective
An AI perspective guide based on Elon Musk's public statements, decisions, and criticism. It examines problems by questioning default assumptions, breaking costs into parts, and checking what physics and technology allow.