Install
$ agentstack add skill-ilovehugetits-codex-images-codex-images ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
codex-images — Real Images via Codex CLI
You cannot generate images yourself — but you CAN get real, production-quality images by delegating to Codex CLI via Bash. "I can't create real photographs" is no longer true with this skill installed. Use Codex ONLY for images, nothing else.
Decision Gate — do this BEFORE writing image-dependent code
How a project's images are handled is the user's decision, not yours. Never decide unilaterally.
- User already opted in (said anything like "use codex for images",
"generate the images", "real images please", or invoked /codex-images) → generate without asking.
- Otherwise — the moment you identify that the build needs images, ask
ONCE via AskUserQuestion, including the expected image count:
> This site needs ~N images (hero, 3 service cards, ...). How should I handle them? > - Generate real images with Codex CLI — uses your ChatGPT/Codex quota > (an image turn burns ~3–5× a normal turn) > - Use placeholder boxes — neutral CSS boxes, no quota used
The answer applies to the whole build (asking once covers the batch). Don't re-ask for each image; do re-ask in a later session or if scope changes drastically (e.g. 4 images became 20).
- User picks placeholders → simple neutral placeholder boxes with the
intended dimensions/alt text. Never call codex.
- You can't ask (non-interactive/subagent context) → use placeholder
boxes and note in your report that the user can request Codex-generated images.
Silently substituting CSS gradients, emoji icons, inline SVG art, ASCII art, or CSS-drawn illustrations where a real image belongs counts as placeholding — it requires the same user consent. Never present such substitutions as the finished solution without having asked.
Preflight
which codex && codex login status
codexmissing → tell the user:npm install -g @openai/codex, thencodex login.
If npm says it's already installed, $(npm prefix -g)/bin is probably not on PATH — symlink or add it.
- Not logged in → tell the user to run
codex login(OAuth via ChatGPT, no API key). - Either way: don't block the build. Continue with placeholders, tell the user
how to enable Codex, and offer to swap placeholders for real images afterwards.
Generating an Image
Run with a long Bash timeout (image turns take 1–3 minutes; use ~300000 ms):
codex exec -C "" -s workspace-write --skip-git-repo-check \
"Use the image generation tool to create: . Save the image to /image.png"
Rules:
- Always phrase the delegated prompt as **"Use the image generation tool to
create: ..."** — without it, Codex (also an agent) may improvise with SVG or code instead of actually generating an image.
- Always pass
-Cwith the project directory and a workspace-relative
output path. Otherwise images land in ~/.codex/generated_images/ instead of where you asked.
- Include style/format requirements in the description (photo vs. illustration,
lighting, palette, "no text", etc.). Keep one consistent style across a site — reuse the same style phrase in every prompt.
- Sizes are best-effort only (the built-in tool has no exact dimension
control). If exact pixels are required: generate close to the target aspect ratio, then resize locally, and tell the user you did so.
- Verify the output exists and is a valid PNG (
file) before reporting
back with its path. If codex fails, report the error verbatim — no fallbacks, no silent downgrade to placeholders without telling the user.
- Generate one image per request. Batch generation is fine only when the
user consented to the batch (the Decision Gate count covers this); ask again before exceeding that count or doing repeated retries.
- In a web project, save into the public assets dir (
public/images/,
static/, assets/ — whatever the framework uses) and reference the real paths in code. Generate after scaffolding the project so the paths exist.
- Generated PNGs are large (1–3 MB). For production web use, mention this to
the user and offer to convert to WebP/JPEG locally (e.g. sips on macOS); don't convert unasked.
Transparent Backgrounds (chroma key)
gpt-image-2 cannot output transparency. For transparent images (logos, cutouts):
- Generate on a solid flat key background — pure green
#00FF00, or
magenta #FF00FF if the subject contains green. Explicitly request: "flat solid #00FF00 background, no gradients, no shadows, no reflections, and no key color anywhere in the subject". Save as image_raw.png.
- Remove the key color with the bundled script (no ImageMagick needed).
From the project directory:
``bash npm install pngjs --no-save node /scripts/chromakey.mjs image_raw.png image.png 00FF00 60 ``
(` = the base directory of this skill, shown when it loads. Pass FF00FF as the third arg if the magenta key was used.) Tolerance: raise (80–100) if key color remains, lower (40–50) if the subject erodes. The script prints how many pixels got alpha 5 min) | Retry once; if it persists, report and ask the user how to proceed. | | Rate limit / quota exhausted | Report verbatim, stop generating, continue build with placeholders for remaining images. | | Trust/sandbox error | Ensure --skip-git-repo-check and -s workspace-write` flags are present. |
Red Flags — STOP if you catch yourself thinking
| Thought | Reality | |---------|---------| | "I can't create real photographs" | You can — delegate to Codex CLI with this skill. | | "CSS gradients/emoji look fine here" | That's a placeholder decision. Ask the user first. | | "Asking would interrupt the flow" | One question, once per build. The user said what, you ask how. | | "I'll just draw it as SVG" | Never substitute SVG/ASCII/drawn art for an agreed real image. | | "Codex failed, I'll quietly use a placeholder" | Report the failure verbatim first; placeholders only with the user informed. |
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ilovehugetits
- Source: ilovehugetits/codex-images
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.