Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add motiful/product-shots --skill product-shots-image-gengit clone --depth 1 https://github.com/motiful/product-shotsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/motiful/product-shots/product-shots-image-gen)<a href="https://agentmods.dev/skills/motiful/product-shots/product-shots-image-gen"><img src="https://agentmods.dev/badge/skills/motiful/product-shots/product-shots-image-gen/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/motiful/product-shots/product-shots-image-gen"><img src="https://agentmods.dev/badge/skills/motiful/product-shots/product-shots-image-gen.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00207 | $0.04303 |
| Opus 5 | $0.00103 | $0.02152 |
| Sonnet 5 | $0.00041 | $0.00861 |
| Haiku 4.5 | $0.00021 | $0.00430 |
Grade B, and why
product-shots-image-gen scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
4. `~/.product_shots_imagegen_api_key` (file, chmod 600, one-line key) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
image_bytes = base64_decode(first["b64_json"]) if "b64_json" in first else fetch(first["url"]) How it starts
The opening of the file, as written. The whole thing — 277 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Image Gen
The image-generation engine of the product-shots ecosystem. A single, parameterised entry point: routes the request to the correct API endpoint based on model family (OpenAI's /v1/images/generations + /v1/images/edits vs Gemini's /v1/chat/completions multimodal), preprocesses reference images, and returns a saved file path.
Primary backend: OmniMaaS / Cloubic image gateway — https://api.omnimaas.com/v1. The gateway is OpenAI-SDK-compatible and unifies access to GPT image 2 and the Gemini Nano Banana family behind one auth token. See:
- GPT image 2 via OmniMaaS: https://docs.cloubic.com/docs/zh-CN/image-generation/image-openai
- Gemini via OmniMaaS: https://docs.cloubic.com/docs/zh-CN/image-generation/image-gemini
Fallback backends: any other OpenAI-SDK-compatible image gateway works — set PRODUCT_SHOTS_IMAGEGEN_BASE_URL + PRODUCT_SHOTS_IMAGEGEN_API_KEY, or keep the legacy CANVASFLOW_IMAGEGEN_* env vars for migrated installs.
Onboarding (First-Use Setup)
Before generating any image, this skill MUST verify an API gateway is configured. If env vars are missing, surface the instructions below to the user verbatim — never silently fall back to a hard-coded key, never ask the user to fork the repo, never ask them to paste a key into chat.
Detection logic
Run on every invocation. The resolution order:
OMNIMAAS_API_KEY(env var, preferred — unified Cloubic / OmniMaaS gateway)PRODUCT_SHOTS_IMAGEGEN_API_KEY(env var, generic fallback)CANVASFLOW_IMAGEGEN_API_KEY(env var, legacy compatibility)~/.product_shots_imagegen_api_key(file, chmod 600, one-line key)~/.canvasflow_imagegen_api_key(file, legacy)
If none resolve, stop and emit the onboarding message in the next section. Do NOT attempt the API call.
Onboarding message (show to user verbatim when env missing)
This skill needs an image-gateway API key before it can generate. You haven't configured one yet — here's the 30-second setup:
Option A — temporary (this terminal only):
export OMNIMAAS_API_KEY="sk-..." # your OmniMaaS / Cloubic token # optional: only set this if you have a private gateway endpoint # export OMNIMAAS_BASE_URL="https://api.omnimaas.com/v1"Option B — persistent across sessions: Add the same
exportline to your~/.zshrc(or~/.bashrc), thensource ~/.zshrc.Option C — file-based (no env vars):
echo "sk-..." > ~/.product_shots_imagegen_api_key chmod 600 ~/.product_shots_imagegen_api_keyWhere the key comes from: docs.cloubic.com — get a token from the OmniMaaS / Cloubic dashboard. The same token covers both OpenAI
gpt-image-2and Geminigemini-3-pro-image-preview(Nano Banana Pro).Any OpenAI-SDK-compatible image gateway also works — replace
OMNIMAAS_*withPRODUCT_SHOTS_IMAGEGEN_BASE_URL+PRODUCT_SHOTS_IMAGEGEN_API_KEYpointing at your gateway.Once configured, re-run the original request.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 277 lines · 207 tokens per session scan B 31038b6c8065
product-shots-image-gen is a skill published in the GitHub repository motiful/product-shots (48 stars, last pushed 3mo ago), licensed MIT. It adds 207 tokens to every session and 4,303 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
magazine-web-ppt
For marketing and gtm work: bind launches, campaigns, events, and brand plans to growth and pipeline outcomes. Built around the core query "annual-marketing-plan", with GTM strategy lead judgment, buyer-ready proof, and this outcome: approve launch plan, campaign budget, or GTM motion.
hatch-pet
Create, repair, validate, preview, and package Codex-compatible animated pet spritesheets from character art, screenshots, generated images, or visual references. Use when a user wants to hatch a Codex pet, create a custom animated pet, or build a built-in pet asset with an 8x9 atlas, transparent unused cells…
ve-midnight-editorial
OpenDesign's financial review: runway, burn, and the sustainability plan that keeps the project independent. Built as a decision-grade data & finance deck for board, leadership.
ve-terminal-mono
OpenDesign from the CLI: driving the full design workflow with the od command — scripted, composable, agent-ready. Built as a decision-grade AI literacy deck for developers, power users.
html-ppt-zhangzara-8-bit-orbit
A gamer's journey building a retro-arcade collection — the obsession, the hunt, and what the machines came to mean. Built as a decision-grade story deck for friends, hobby community.
html-ppt-zhangzara-blue-professional
OpenDesign's QBR for the executive committee: what moved, what stalled, and the resource reallocation ask. Built as a decision-grade corporate strategy deck for executive committee.