Content & Media Creation · JimLiu/baoyu-skills
baoyu-image-gen
AI image generation with OpenAI GPT Image 2.5, Azure OpenAI, Google, OpenRouter, DashScope, Z.AI GLM-Image, MiniMax, Jimeng, Seedream, Replicate and Agnes APIs. Supports text-to-image, reference images, aspect ratios, and batch generation from saved prompt files. Sequential by default; use batch parallel generation when the user already has multiple prompts or wants stable multi-image throughput. Use when user asks to generate, create, or draw images.
L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedReverse APITerms / ComplianceExecute CommandNetwork AccessWrite FileDual-pass Audit
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.
1How It Works & Mechanism
Implemented via a custom provider adaptation layer: one module per vendor, uniformly exporting generateImage(prompt, model, args), dispatched by the main script based on provider; request payloads, dimensions, and quality rules are implemented independently.
skills/baoyu-image-gen/scripts/main.ts
const imageData = await task.providerModule.generateImage(task.prompt, task.model, task.args);
What it does: Unifies differences across 12 image APIs (dimension syntax, reference image support, edit endpoints) into a single internal interface, leaving the main script responsible only for selecting providers, parsing arguments, retrying, and writing to disk.
Provider auto-selection is determined by 'which keys exist', while codex-cli is explicitly excluded from auto-selection.
skills/baoyu-image-gen/scripts/main.ts
const hasGoogle = !!(process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY);
Corresponding rule in SKILL.md: `5. `codex-cli` is **never auto-selected** — set `default_provider: codex-cli` in EXTEND.md or pass `--provider codex-cli`.` — switching to the Codex subscription channel requires explicit user designation.
API keys and model configurations follow a strict priority chain: CLI > EXTEND.md > Environment Variables > <cwd>/.baoyu-skills/.env > ~/.baoyu-skills/.env; missing keys trigger provider-specific errors with retrieval instructions.
skills/baoyu-image-gen/scripts/main.ts
Env file load order: CLI args > EXTEND.md > process.env > <cwd>/.baoyu-skills/.env > ~/.baoyu-skills/.env
In code: `const homeEnv = await loadEnvFile(path.join(home, ".baoyu-skills", ".env"));` and `const cwdEnv = await loadEnvFile(path.join(cwd, ".baoyu-skills", ".env"));` load both .env files into process.env (without overwriting existing values), after which providers access process.env directly.
Batch parallel generation utilizes an actual worker pool combined with provider-level throttling (concurrency limits and launch intervals), retrying up to 3 times per image.
skills/baoyu-image-gen/scripts/main.ts
const enoughCapacity = current.active < limit.concurrency;
Constants `const MAX_ATTEMPTS = 3;` and `const DEFAULT_MAX_WORKERS = 10;`; per-provider defaults such as `replicate: { concurrency: 5, startIntervalMs: 700 },`, overrideable via `BAOYU_IMAGE_GEN_<PROVIDER>_CONCURRENCY` / `_START_INTERVAL_MS`. Batch mode automatically activates when --batchfile contains 2+ tasks.
Batch tasks are driven by JSON files, accompanied by an assembler that combines outline.md and the prompts/ directory into batch.json to serve article illustration pipelines.
skills/baoyu-image-gen/SKILL.md
# Build a batch file from outline.md + prompts/ (e.g. baoyu-article-illustrator output)
Corresponding command: `scripts/build-batch.ts --outline outline.md --prompts prompts --output batch.json --images-dir attachments`.
The codex-cli provider does not use an API key; instead, it spawns the local codex CLI (using its logged-in subscription state) to run a bundled codex-imagegen wrapper script, which validates whether image_gen was actually invoked in the turn.
skills/baoyu-image-gen/scripts/providers/codex-cli.ts
const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
SKILL.md notes: `The provider spawns the bundled `scripts/codex-imagegen/main.ts``; validation logic resides in codex-imagegen/main.ts (`image_gen was not invoked (no image_gen event in stream; ${ver.reason})`), inspecting `$CODEX_HOME/generated_images/<threadId>` to verify artifacts generated during the turn.
Reference image identity consistency relies on systematic prompt discipline rather than guesswork: SKILL.md provides concise, rigid identity-retention phrases and explicitly allowed modification dimensions to avoid replacing the reference image with vague descriptions.
skills/baoyu-image-gen/SKILL.md
Do not redesign it or create a similar-looking new subject.
Counter-examples illustrate that long face descriptions cause the model to generate a new character rather than preserving identity; it also recommends 2-4 curated reference images and cautions against using new outputs as recursive references (drift accumulation).
Quality and size feature dual mapping schemes: preset normal/2k (default 2k) maps to provider parameters, while native OpenAI maps to quality=medium/high and 2048px-level valid dimensions, constrained to multiples of 16, max edges, and aspect ratios.
skills/baoyu-image-gen/SKILL.md
width/height must be multiples of 16, max edge 3840px, ratio no wider than 3:1
Google/OpenRouter also support --imageSize 1K|2K|4K; flash-lite only outputs 1K, and passing 2K/4K will be clamped with a warning.
2Core Capabilities
01Multi-provider text-to-image generation (Google/OpenAI/Azure/OpenRouter/DashScope/Z.AI/MiniMax/Jimeng/Seedream/Replicate/Agnes/codex-cli)
02Reference image (--ref) driven editing/identity preservation, validated per provider capabilities (unsupported combinations fail immediately with corrective guidance)
03Batch parallel generation (worker pool + provider-level concurrency/launch intervals + 3 retries per image + aggregated success/failure logs)
04batch.json workflow and build-batch.ts assembler (outline + prompts → batch file)
05Model resolution priority and per-provider overrides (CLI/EXTEND.md/env three-layer hierarchy + <PROVIDER>_IMAGE_MODEL)
06EXTEND.md preference system (default provider/quality/aspect ratio/dimensions/per-provider default models/batch caps), with automatic migration from legacy baoyu-imagine paths
07OpenAI-compatible gateway dialect switching (openai-native / ratio-metadata)
3External Dependencies
| Kind | Dependency / Endpoint |
|---|---|
| api | OpenAI Images API（gpt-image-2.5-flare 默认） |
| api | Azure OpenAI（deployment + api-version） |
| api | Google Gemini 图像生成（gemini-3-pro-image 默认） |
| api | OpenRouter（/chat/completions 流程） |
| api | 阿里云 DashScope（qwen-image-2.0-pro 默认） |
| api | Z.AI / 智谱（GLM-Image、cogview-4） |
| api | MiniMax image-01 |
| api | 火山引擎即梦（Jimeng，V4 签名，AccessKey/SecretKey） |
| api | 火山引擎 ARK / Seedream（豆包） |
| api | Replicate（nano-banana / seedream / wan 等家族） |
| api | Agnes |
| cli | codex CLI（本地订阅登录态；codex exec 通道） |
| cli | bun（运行 TS 脚本；缺 bun 时 npx -y bun） |
4Recommended Governance & Evidence
Suggested Controls for Safe Operation
For Agent Runtime
Isolated environment, per-use explicit authorization
For Administrators
Strict authorization, full audit, compliance signoff
Evidence & Triggers (File Paths & Excerpts)
- SKILL.md / 脚本: Calling undocumented or reverse-engineered private APIs / spoofing client identity
- SKILL.md / 脚本参数: Involves bypassing automated checks, disabling host sandboxes, or skipping SSL certificate verification
- scripts/: Executes local scripts or commands: bun {baseDir}/scripts/main.ts (single image or --batchfile batch mode)
- 网络端点: Declares external network access: api.openai.com / *.openai.azure.com (including custom AZURE_OPENAI_BASE_URL)
- 本地工作目录: File read/write and artifact output: writes image files based on paths specified by --image/--batchfile; outputs multiple images and aggregates them by task in batch mode
Audit Notes: Red rating is assigned at the 'capability/policy' level with evidence within this skill directory: (1) [Security downgrade + arbitrary code execution surface] The wrapper script `skills/baoyu-image-gen/scripts/codex-imagegen/spawn.ts` for the codex-cli channel launches `codex exec` with `"--sandbox", "danger-full-access"` (disabling the Codex sandbox), while `scripts/codex-imagegen/main.ts` interpolates `PROMPT:\n${prompt}` verbatim into instructions sent to that agent, explicitly stating 'The output and ref paths are interpolated raw into the agent instruction / sent to `codex exec --sandbox danger-full-access`', only validating shell metacharacters on --image/--ref paths—meaning arbitrary prompt text from files is consumed directly in an un-sandboxed agent execution surface. (2) [Reading credentials] The main execution path (non-codex branch) reads API keys across 11 providers (including <cwd>/.baoyu-skills/.env and ~/.baoyu-skills/.env) for declared functionality. Trigger condition: (1) is triggered only when explicitly specified via `--provider codex-cli` or `default_provider: codex-cli` in EXTEND.md (SKILL.md: `codex-cli` is never auto-selected); the default provider path does not lower sandboxes and only warrants an orange rating (credential reading + outbound data), but because (1) hits a capability-level red line, the skill is rated Red overall. No reverse-engineered APIs, client spoofing, or TLS downgrades detected.
5Second-Pass Verification
- [ok] 12 家 provider 的端点与默认模型 — 逐个文件核对：openai.ts(api.openai.com/v1, gpt-image-2.5-flare)、azure.ts、google.ts(gemini-3-pro-image)、openrouter.ts、dashscope.ts(qwen-image-2.0-pro)、zai.ts、minimax.ts、jimeng.ts(jimeng_t2i_v40)、seedream.ts(doubao-seedream-5-0-260128)、replicate.ts(google/nano-banana-2)、agnes.ts(agnes-image-2.5-flash)、codex-cli.ts；与 SKILL.md 描述一致。
- [ok] 密钥读取清单 — SKILL.md 的 Environment Variables 表逐项在代码中命中对应 process.env 读取；另有 <PROVIDER>_BASE_URL 覆盖（jest 风格测试里也验证了 base URL 拼接）。
- [ok] codex-cli 存在 --sandbox danger-full-access（安全降级） — skills/baoyu-image-gen/scripts/codex-imagegen/spawn.ts 内 args 含 '"--sandbox"' 与 '"danger-full-access"'；同目录 main.ts 注释与 assertSafePath 佐证该指令会被直接交给 codex。
- [ok] prompt 被逐字插入无沙箱 agent 指令 — codex-imagegen/main.ts 的 buildInstruction 返回模板内含 'PROMPT:' 后接 ${prompt}，逐字使用；main.ts:104-109 注释说明只对 output/ref 路径做元字符校验，未覆盖 prompt 内容。
- [ok] codex-cli 不会被自动选中（红线触发条件） — SKILL.md Provider Selection 第 5 条与 main.ts 的 has* 判定均不含 codex-cli；需显式 --provider 或 EXTEND.md。
- [ok] 批量并行与重试参数 — main.ts 常量 MAX_ATTEMPTS=3、DEFAULT_MAX_WORKERS=10、provider 级 concurrency/startIntervalMs 表（codex-cli 为 concurrency=1/2000ms），与 SKILL.md 文案一致。
- [ok] 『Codex OAuth 不等于 API key』的说明与代码一致 — SKILL.md 明写不要把 Codex OAuth token 塞进 OPENAI_API_KEY；代码中 openai provider 只读 OPENAI_API_KEY，codex-cli 走独立 spawn 通道，未混用。
- [discrepancy] 红线判级与上游口头结论的关系 — 批4 口径曾一度把 image-gen 判为 orange（理由假设『无绕过/降级』）。本目录 evidence 与该假设不符：目录内确含 `--sandbox danger-full-access` 与 raw prompt 插值（上方两条 ok）。故按『证据优先』记 red，并在 reason 写明触发条件（仅 codex-cli 通道）；默认 provider 路径仍为橙级行为。
6Verdict & Scenarios
Best for: Ideal for workflows requiring cross-vendor price/quality comparisons, and users with existing prompt collections (article illustrations, comic storyboards, bulk cover generation). Also fits users who have a Codex subscription without an OpenAI API key but want to generate images in batches (via codex-cli, understanding its sandbox settings). When used as an image backend for other skills (such as baoyu-article-illustrator, baoyu-infographic), it provides unified retries, caching, and rate limiting.
Not for: Not suitable for scenarios feeding untrusted prompts directly into the codex-cli channel (danger-full-access + verbatim interpolation); not suitable for environments requiring zero keys on disk or enterprise intranets prohibiting outbound access; not suitable for mass production demanding strict budget caps and deterministic billing (no budget breakers, retries enabled by default); users who do not need these capabilities can use host-native image tools instead.
Install Agent-Ready
① Verified Mirror 2026-09-15
Option A · Direct DownloadDownload baoyu-image-gen.tar.gz
sha256:
Option B · Copy Guide for Agent4faafab87aede136…Agents automatically download and verify mirrors from this JSON guide.
② Upstream GitHub
GitHub Repo ↗
Pinned to commit 1567581c26.