·
Last changedVersion:
This version passed the hardening gate. Hardening applied 4 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 1. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 4. Review findings remaining: 7.
1
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed |
1 finding
runcomfy.com · Edit endpoint · Text-to-image sibling
OpenAI GPT Image 2 — /edit endpoint (ChatGPT Images 2.0 image-to-image) on the RunComfy Model API. Strongest in its class at preserving identity through targeted edits and rewriting embedded text in any script (Latin, kana, CJK, Cyrillic, Arabic).
| You want | Use |
|---|---|
Edit multilingual / embedded text in image | GPT Image Edit |
Identity preservation through translated headline variants | GPT Image Edit |
Layout-precise edit (move headline, swap CTA, etc.) | GPT Image Edit |
Up to 10 reference images | GPT Image Edit |
Batch up to 20 images consistently | Nano Banana Edit |
Single-shot precise local edit, source-fidelity-first | Flux Kontext |
Generate from scratch with GPT Image 2 | sibling |
Batch SKU galleries with stable identity | Nano Banana Edit |
npm i -g @runcomfy/cliruncomfy login opens a browser device-code flow.RUNCOMFY_TOKEN=<token> instead of runcomfy login.openai/gpt-image-2/edit| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | Edit instruction. Lead with preservation, end with the change. |
| string[] | yes | — | Up to 10 publicly-fetchable HTTPS URLs. First is primary; rest are auxiliary. |
| enum | no |
|
|
size=auto preserves the input ratio — strongly recommended unless the edit explicitly changes framing.
Single-ref preservation edit:
Multilingual text rewrite (preserve everything except the headline):
Multi-ref composition:
Lead with preservation goals. Always: "Keep [face / pose / clothing / brand / framing] unchanged." Then state the change. The model honors what's stated up front.
Multilingual text — quote the characters, name the script. "the headline reads \"コーヒー\" in bold Japanese kana", "the label says \"АРОМА\" in Cyrillic, white on black", "the right-margin caption reads \"تخفيض\" in Arabic right-to-left". Don't paraphrase — quote.
Directional language for spatial edits. Concrete spatial scopes work: "move the headline from top-right to bottom-center", "remove the leftmost object only", "replace the watermark in the bottom-right corner".
Multi-ref numbering. When passing multiple images, refer to them by number: "subject from image 1, lighting from image 2, color palette from image 3". The model routes cues correctly.
Use size: "auto" to preserve input ratio. Only override when the edit explicitly changes framing (e.g. cropping a 16:9 to 1:1).
Anti-patterns:
size outside the 3 fixed values + auto → 422.| Use case | Why GPT Image Edit |
|---|---|
Multilingual ad localization | One source asset → many language variants of the same headline |
Brand-safe headline / CTA swaps | Layout precision + preservation language hold the rest stable |
Multi-ref composition (subject from one, scene from another) | Numbered refs route cues correctly |
Layout-precise repositioning | Directional language ("top-right to bottom-center") honored |
Identity preservation across signage edits | Strongest in class for face / brand preservation through targeted edits |
Background swap with full preservation (page example):
Multilingual variant:
Multi-ref composition:
size: 3 fixed values + auto — anything else 422s.images: up to 10 — first is primary, rest are auxiliary cues.| code | meaning |
|---|---|
0 | success |
64 | bad CLI args |
65 | bad input JSON / schema mismatch |
69 | upstream 5xx |
75 | retryable: timeout / 429 |
77 | not signed in or token rejected |
Full reference: docs.runcomfy.com/cli/troubleshooting.
The skill invokes runcomfy run openai/gpt-image-2/edit with a JSON body matching the schema. The CLI POSTs to https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/edit, polls the request, fetches the result, and downloads any .runcomfy.net/.runcomfy.com URL into --output-dir. Ctrl-C cancels the remote request before exit.
runcomfy login writes the API token to ~/.config/runcomfy/token.json with mode 0600 (owner-only read/write). Set RUNCOMFY_TOKEN env var to bypass the file entirely in CI / containers.--input.model-api.runcomfy.net (request submission) and *.runcomfy.net / *.runcomfy.com (download whitelist for generated outputs).Get started with chainctlchainctl skill install public/agentspace-so/gpt-image-edit:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/agentspace-so/gpt-image-edit:latest
MIT
HARDENING.md
LICENSE
SKILL.md