oma-image — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oma-image (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate images and visual assets through authenticated multi-vendor routing while preserving prompt clarity, reference-guided regeneration, cost controls, and reproducible output manifests.
.agents/results/images/ or requested output directorymanifest.json with prompt, vendor, model, and reproducibility metadata--vendor all is usedoma image generate CLI and vendor authenticationresources/vendor-matrix.md, resources/prompt-tips.md, and the image: section of .agents/oma-config.yaml--vendor all is requested, require every requested vendor to be available.oma update.oma image generate, oma image doctor, oma image vendor listoma image doctor
oma image generate "<prompt>" --vendor auto --size auto --quality auto --output jsonWith reference images:
oma image generate --reference "<absolute-path>" --vendor codex "<prompt>"| Scope | Resource target |
|---|---|
LOCAL_FS | Reference images, generated images, manifests |
PROCESS | Provider CLIs and image router commands |
NETWORK | Pollinations/Gemini or provider APIs |
CREDENTIALS | Provider auth and API keys |
--vendor all, every requested vendor must be available (strict). Caveat: the antigravity health check verifies installation only (agy --version) — a signed-out agy passes health and fails at generate time with agy's own error.$0.20 (configurable). --yes / OMA_IMAGE_YES=1 bypass. Choose generation from the requested outcome, not keyword presence. Non-interactive contexts (agents, CI — no TTY on stdin): the CLI cannot prompt, so a run at/over the threshold exits 1 with a message naming --yes. Use --dry-run to estimate cost. Reuse an existing budget authorization; otherwise confirm the additional spend before re-running with -y.$PWD require --allow-external-output.manifest.json next to the images for reproducibility.Use the requested subject and constraints. Infer setting, style, lighting, and aspect ratio when unspecified; preserve explicit text and reference intent. Ask only for a material unresolved choice. Read resources/prompt-tips.md for an unfamiliar image category.
resources/invocation.md (selected vendor or reference-image operation only).Project-specific settings: the image: section of .agents/oma-config.yaml, which oma update preserves. Shipped defaults live in the CLI (DEFAULTS in cli/commands/image/config.ts) — write only the keys you change. The legacy config/image-config.yaml is no longer read by the CLI; migration 022 moves anything you had changed there into oma-config (and deletes the file when it was never edited). Env vars: OMA_IMAGE_DEFAULT_VENDOR, OMA_IMAGE_DEFAULT_OUT, OMA_IMAGE_YES, POLLINATIONS_API_KEY.
resources/execution-protocol.mdresources/vendor-matrix.mdresources/prompt-tips.mdresources/checklist.md../_shared/core/context-loading.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.