Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xerrors/yuxi/image-gennpx skills add xerrors/Yuxi --skill image-gengit clone --depth 1 https://github.com/xerrors/YuxiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.00855 |
| Opus 5 | $0.00024 | $0.00428 |
| Sonnet 5 | $0.00010 | $0.00171 |
| Haiku 4.5 | $0.00005 | $0.00085 |
Grade B, and why
image-gen scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
response = requests.post( "https://api.siliconflow.cn/v1/images/generations", Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
response = requests.post( How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
图片生成技能
当用户要求生成图片、海报、插画、文生图,或明确提到 Qwen-Image 时,使用此技能组织图片生成流程。
默认生成接口
默认使用 SiliconFlow 的 Qwen-Image 接口:
- Endpoint:
POST https://api.siliconflow.cn/v1/images/generations - Model:
Qwen/Qwen-Image - 默认参数:
negative_prompt:""num_inference_steps:20guidance_scale:7.5
调用外部接口时,必须在 Agent 沙盒执行环境中读取 SILICONFLOW_API_KEY。不要依赖后端进程环境变量。
操作流程
- 明确用户要生成的图片内容、风格、尺寸或约束;信息不足但不影响生成时,使用合理默认值,不要反复追问。
- 使用可用的执行工具在沙盒中运行脚本,调用图片生成接口,传入用户需求整理后的
prompt,并按需传入negative_prompt、num_inference_steps、guidance_scale。 - 从生成接口响应中读取图片地址,默认路径为
images[0].url。 - 在同一个沙盒脚本中用
Authorization: Bearer $SILICONFLOW_API_KEY下载该图片地址;如果接口直接返回 base64,则直接解码保存。 - 将最终图片保存到当前 Workdir 的
outputs/下,例如outputs/generated-image.png。 - 调用
present_artifacts,传入保存后的 outputs 虚拟路径,让前端展示图片产物。 - 最终回复简要说明图片已生成,不要把外部临时 URL 当作最终结果展示。
脚本示例
可根据用户需求调整 prompt 和输出文件名:
import os
import requests
from pathlib import Path
api_key = os.environ["SILICONFLOW_API_KEY"]
prompt = "根据用户需求整理后的图片提示词"
response = requests.post(
"https://api.siliconflow.cn/v1/images/generations",
headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
json={
"model": "Qwen/Qwen-Image",
"prompt": prompt,
"negative_prompt": "",
"num_inference_steps": 20,
"guidance_scale": 7.5,
},
timeout=120,
)
response.raise_for_status()
image_url = response.json()["images"][0]["url"]
image_response = requests.get(
image_url,
headers={"Authorization": f"Bearer {api_key}"},
timeout=120,
)
image_response.raise_for_status()
output_path = Path("outputs/generated-image.png")
output_path.parent.mkdir(parents=True, exist_ok=True)
output_path.write_bytes(image_response.content)
print(output_path.as_posix())
多模型扩展
如果用户指定其它图片生成模型或兼容接口,可以按该接口的协议先生成图片。只要最终拿到图片 bytes 或 base64,就保存到当前 Workdir 的 outputs/,再调用 present_artifacts 展示。
关键约束
- 不要把外部生成接口返回的临时 URL 当作最终结果直接展示给用户。
- 不要调用后端 MinIO 上传工具;图片生成和下载都应在沙盒内完成。
- 如果
SILICONFLOW_API_KEY缺失,应明确提示用户需要在 Agent 沙盒环境变量中配置。 - 保存到 outputs 后必须调用
present_artifacts,否则前端不会自动展示生成图片。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 83 lines · 48 tokens per session scan B 667165f2a46d
image-gen is a skill published in the GitHub repository xerrors/Yuxi (6,606 stars, last pushed 2d ago), licensed MIT. It adds 48 tokens to every session and 855 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ardot_poster
"Use this skill for Ardot canvas design tasks whose deliverable is a visual poster — posters, flyers, billboards, banners, event posters, promotional single-page graphics, e-commerce banners, brand visuals, logos, icons & illustrations rendered on the Ardot canvas. Trigger phrases: design a poster, create a banner…
voice-tts
Text-to-speech output for voice responses. Uses pyttsx3 for local TTS on supported systems.
flickies
Self-hosted video REST + MCP API. POST JSON, get a video back. Lipsync (LatentSync 1.5 + Wav2Lip/Wav2Lip-GAN) at /v1/video/lipsync, GFPGAN face restore at /v1/video/restore, pure-ffmpeg ops (trim, concat, transcode incl. gif + fps + codec, scale, muxaudio, extractaudio, thumbnailgrid) under /v1/video/, and ffprobe…
audiolla
HTTP/MCP client for a user-deployed audiolla audio-production server. Use ONLY when the user has explicitly named audiolla AND provided AUDIOLLAURL (or has it set in the environment). Capabilities: stem separation (Demucs / MDX / BS-Roformer), mastering (matchering reference / pedalboard preset chain), MIR analysis…
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.
rag-knowledge
Work with the RAG knowledge base — ingest documents, run semantic search, manage collections, or add a sync source/connector (Google Drive, S3). Use when populating or debugging the knowledge base, tuning retrieval, or adding a new document source. This project uses {{ cookiecutter.vectorstore }} + {{…