Image Matching WebUI is a graphical tool for finding corresponding keypoints between two images with different image-matching algorithms. Users can select local or webcam images, choose an algorithm, and inspect the matching result through a Gradio interface.
Borrowing it
Nothing to install: this file belongs to Vincentqyw/image-matching-webui. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Vincentqyw/image-matching-webui/main/.claude/skills/deploy-hf/SKILL.mdgit clone --depth 1 https://github.com/Vincentqyw/image-matching-webuiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vincentqyw/image-matching-webui/deploy-hf)<a href="https://agentmods.dev/skills/vincentqyw/image-matching-webui/deploy-hf"><img src="https://agentmods.dev/badge/skills/vincentqyw/image-matching-webui/deploy-hf/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vincentqyw/image-matching-webui/deploy-hf"><img src="https://agentmods.dev/badge/skills/vincentqyw/image-matching-webui/deploy-hf.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 38 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.00797 |
| Opus 5 | $0.00019 | $0.00398 |
| Sonnet 5 | $0.00008 | $0.00159 |
| Haiku 4.5 | $0.00004 | $0.00080 |
Grade A, and why
deploy-hf scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deploy to HuggingFace Spaces
This skill handles the full release pipeline: version bump → tag → release → deploy to HF test → deploy to HF prod.
Prerequisites
- Working inside
image-matching-webuiproject root - Authenticated with GitHub (
gh) and HuggingFace (hf) - HF git credential configured (see branch setup below)
Branch Setup (one-time)
# Add HF remotes (only needed once)
git remote add hf-test https://huggingface.co/spaces/Realcat/imcui
git remote add hf-prod https://huggingface.co/spaces/Realcat/image-matching-webui
# Configure git credential for HF
git config --global credential.https://huggingface.co.username Realcat
Release & Deploy Workflow
Step 1: Release new version on GitHub
# On main branch
# 1. Bump version in pyproject.toml
# 2. Add any new deps to requirements.txt
# 3. Commit
git add pyproject.toml requirements.txt
git commit -m "chore: bump version to X.Y.Z"
git push origin main
# 4. Tag and release
git tag -a vX.Y.Z -m "vX.Y.Z: <description>"
git push origin vX.Y.Z
gh release create vX.Y.Z --title "vX.Y.Z" --notes "..."
This triggers two CI workflows:
docker-publish.yml(on tagv*) → Docker Hub imagerelease.yml(on release published) → PyPI whl
Step 2: Update huggingface branch
git checkout huggingface
# Update requirements.txt: imcui==X.Y.Z
git add requirements.txt
git commit -m "chore: bump imcui to X.Y.Z"
git push origin huggingface
Step 3: Deploy to test Space
Wait for PyPI release to complete (~10 min), then:
git push hf-test huggingface:main --force
Verify at https://huggingface.co/spaces/Realcat/imcui
Step 4: Deploy to production Space
After confirming test Space works:
git push hf-prod huggingface:main --force
HuggingFace Space Configuration
The huggingface branch is a lightweight orphan branch containing only deployment files:
| File | Purpose |
|---|---|
app.py |
Launcher importing from imcui package |
requirements.txt |
imcui==X.Y.Z (pulls all deps from PyPI) |
packages.txt |
System deps: build-essential, ffmpeg, libsm6, libxext6 |
config/app.yaml |
Full matcher zoo config |
README.md |
HF metadata: sdk: gradio, python_version: "3.12", pinned: true |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 103 lines · 38 tokens per session scan A 271c9a42aa14
deploy-hf is a skill published in the GitHub repository Vincentqyw/image-matching-webui (1,301 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 38 tokens to every session and 797 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
land-and-deploy
Land and deploy workflow. (gstack).
publish-site
Versioned site deploys to GitHub/Cloudflare/Netlify Pages.
cs-ending-time
Use when the user asks to finish, ship, publish, commit, push, or deploy a completed implementation in one bounded delivery scope.
land-and-deploy
Land and deploy workflow. Merges the PR, waits for CI and deploy, verifies production health via canary checks. Takes over after /ship creates the PR. Use when: "merge", "land", "deploy", "merge and verify", "land it", "ship it to production". (gstack).
deploy
Deploy latest master to production with a version tag. Use when releasing to production or tagging a deploy.
ship
Use when code is ready to ship — creates PRs, merges, deploys, and verifies. Handles the full PR-to-production pipeline. Triggers on /ship.