Growth Lab is an open-source growth system that uses coding agents to understand a product, research markets, execute growth activities, and learn from the results. It is designed for teams that want to manage growth work across channels such as SEO and Xiaohongshu through natural-language collaboration, persistent product context, and recorded outcomes. Catalogue add-ons define parts of its product models, research methods, execution workflows, and agent operation.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tsingyuai/growth-lab --skill generate-imagegit clone --depth 1 https://github.com/tsingyuai/growth-labWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tsingyuai/growth-lab/generate-image)<a href="https://agentmods.dev/skills/tsingyuai/growth-lab/generate-image"><img src="https://agentmods.dev/badge/skills/tsingyuai/growth-lab/generate-image/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tsingyuai/growth-lab/generate-image"><img src="https://agentmods.dev/badge/skills/tsingyuai/growth-lab/generate-image.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 3 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.00792 |
| Opus 5 | $0.00036 | $0.00396 |
| Sonnet 5 | $0.00015 | $0.00158 |
| Haiku 4.5 | $0.00007 | $0.00079 |
Grade A, and why
generate-image scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Generate images
Use executors/generate-image/generate-image.mjs for text-to-image and reference-image editing.
It is a repository-owned, zero-dependency Node.js client. Do not call Codex system Skills, private scripts, or files under ~/.codex.
Define the asset
Specify:
- placement and purpose;
- subject and visible action;
- composition and aspect ratio;
- visual style and brand palette;
- exact text when text is essential;
- details that must appear;
- artifacts, logos, watermarks, and unrelated text to exclude.
Prefer real product screenshots when the image explains product behavior. Use generated visuals for concepts, scenes, covers, illustrations, diagrams, and supporting examples.
Generate
Use a prompt file for long or multilingual prompts:
node executors/generate-image/generate-image.mjs \
--out <output.png> --prompt-file <prompt.txt>
Choose OpenAI explicitly when appropriate:
node executors/generate-image/generate-image.mjs \
--model gpt-image-2 --out <output.png> \
--prompt-file <prompt.txt>
Add one --ref <image> argument for each reference image used in an edit.
For JSONL batch generation, put one job per line with prompt or prompt_file, out, and optional model, refs, size, or quality:
node executors/generate-image/generate-image.mjs \
--batch <jobs.jsonl> --out-dir <directory> --concurrency 3
Read GEMINI_API_KEY or OPENAI_API_KEY from the process environment, root .env.local, or root .env, in that precedence order. Use GOOGLE_GEMINI_BASE_URL or OPENAI_BASE_URL only for a compatible HTTPS endpoint. Keep credentials out of prompts, files, logs, and commits.
Do not read credentials from another application's private authentication files.
Before the first provider call, run python models/onboard-growth-lab/scripts/check_configuration.py. If image generation is optional-missing, tell the user that collection, copywriting, review, and deterministic rendering can continue without an image API. When generated assets are requested, point to CONFIGURATION.md, name the OpenAI and Gemini field options, and wait for the user to configure or skip. Never ask them to paste a key into the conversation. A paid verification call requires separate approval.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 77 lines · 73 tokens per session scan A 3e32f3295a89
generate-image is a skill published in the GitHub repository tsingyuai/growth-lab (1,999 stars, last pushed 29d ago), licensed Apache-2.0. It adds 73 tokens to every session and 792 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
synthesis-explore
Synthesis EXPLORE stage for the Diffmode growth-tactics pipeline (fuses the blind-combination draw + emergent-mechanism derivation — formerly two separate synthesis steps — into ONE structural-check-only stage). Reads the per-run growth-factors.json (LIGHT vector DB) + synthesis-constraints.json + founder-input +…
growth-factors-mining
Builds a per-run LIGHT growth-vector database for the Diffmode growth-tactics pipeline by mining public growth case studies fresh, every run, and distilling each into atomic "growth factors" (transferable mechanisms). Clean-room — NEVER reads the proprietary tacticsDB. Outputs growth-factors.json (20-40 vectors spread…
diagnostics-intake
Fast founder-input capture for the Diffmode growth-tactics pipeline (the diagnostics stage). Produces WS/01-diagnostics/founder-input.md in the exact schema the enrichment + synthesis stages read. Two modes — (A) URL mode researches a product's website (homepage/pricing/about) plus a web-research pass to prefill the…
lite-constraints
Generates synthesis-constraints.json for the Diffmode growth-tactics pipeline by reasoning in-context over the per-run growth-factors.json (LIGHT vector DB) + founder context — the clean-room, no-Python replacement for the proprietary Python constraints generator. Emits the white-space pairs, mandatory…
viral-marketing-playbook
Design viral loops into your product — referral programs, invite systems, and share mechanics that drive exponential growth. Includes K-factor calculations and real examples from Dropbox, Slack, and Notion. By @WeiYipei.
ad-angles
Use this skill to brainstorm ad concepts across problem, solution, comparison, proof, and curiosity angles, formats, and visual styles. Trigger it when planning a campaign, refreshing stale creative, testing messaging, or preparing creative briefs.