decor-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited decor-cli (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
decor-cli technical banner
decor-cli decorates images and videos from a CLI or MCP server. It adds backgrounds, gradients, rounded containers, shadows, padding, crop, alignment, text, arrows, shapes, counters, spotlight, and template presets without distorting the original media ratio.
How decor-cli works
decor-cli feature map
npm install -g decor-cli
decor install-backgroundsVideo rendering uses system ffmpeg and ffprobe. Install them with your OS package manager or set DECOR_FFMPEG_PATH and DECOR_FFPROBE_PATH.
decor render --input screenshot.png --output output.png --template clean-gradient --text "Release notes" --overwrite
decor render --input screenshot.png --output output.png --background-folder ~/.decor-cli/backgrounds --padding 104 --radius 38 --overwrite
decor render --input demo.mp4 --output demo-decorated.mp4 --padding 96 --radius 36 --overwrite
decor install-backgrounds --dir ./backgrounds
decor list-templates
decor doctor --jsonURL and Base64 inputs are supported:
decor render --input-url https://example.com/image.png --output output.png
decor render --input-base64 "$DATA_URI" --output output.pngPrivate, loopback, link-local, and metadata URL targets are blocked by default. Use --allow-private-network only for trusted local fixtures.
Run decor install-backgrounds on a fresh machine to download this hosted background pack into ~/.decor-cli/backgrounds.
Default background gallery
Most advanced features are configured through JSON:
{
"template": "clean-gradient",
"input": { "type": "path", "path": "screenshot.png" },
"output": { "path": "output.png", "quality": 92, "overwrite": true },
"container": { "padding": 96, "radius": 36, "alignment": "center" },
"annotations": [
{ "type": "text", "text": "Step 1", "x": 80, "y": 90, "fontSize": 44, "shadow": true },
{ "type": "counter", "value": 1, "x": 110, "y": 160, "size": 42 },
{ "type": "arrow", "from": { "x": 120, "y": 180 }, "to": { "x": 260, "y": 220 } }
]
}Run it:
decor render --config decor.config.json --output output.pngdecor-mcp --transport stdio
DECOR_MCP_TOKEN=example-token decor-mcp --transport http --port 8080MCP tools: render_decor, preview_decor, validate_decor, list_templates, doctor, and config_resolve.
Conventional commits drive releases with semantic-release:
main -> stable GitHub release and npm latestdev -> beta prerelease and npm betaGitHub releases also include runtime archives named like decor-cli-vX.Y.Z-linux-amd64.tar.gz for installers that resolve assets by OS and architecture.
Publish jobs are separated from PR CI and should be protected with the release environment. Set the repository NPM_TOKEN secret before the first live publish.
decor install-backgrounds downloads the hosted default background pack from Cloudflare R2 into ~/.decor-cli/backgrounds. The installer verifies every file by byte length and SHA-256 before replacing local files. Use --dir <path> to install elsewhere and --force to redownload files that already match the manifest.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.