OpenClaw/Claude Code SKILL.md for gpt-image-2 via Codex OAuth, no OPENAI_API_KEY required
SaferSkills independently audited codex-gpt-image (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to generate or edit images through Codex OAuth instead of the OpenAI API-key path. The bundled CLI reads the local Codex auth file and calls the Codex Images backend endpoints.
gpt-image-2 or GPT Image through Codex auth/subscription.SKILL.md but does not have a native image tool.OPENAI_API_KEY.Do not use this skill when the user wants the official OpenAI Images API, an OpenAI-compatible gateway, or API-key billing. This skill is deliberately Codex-OAuth-only.
All CLI commands below assume the working directory is this skill folder. Otherwise, resolve the absolute path to scripts/codex_gpt_image.py from this SKILL.md.
python3 scripts/codex_gpt_image.py auth-status python3 scripts/codex_gpt_image.py login --open-browserThe CLI prints a browser URL and a short user code. The user must complete this step; never ask them to paste tokens.
--image inputs. For edits, build the prompt from the user's requested changes and the invariants that must stay unchanged.~/.codex/auth.jsonCODEX_AUTH_FILE=/path/to/auth.jsonlogin uses OpenAI Codex device-code auth and writes the same auth file--client-id, CODEX_APP_SERVER_LOGIN_CLIENT_ID, then the public Codex defaulthttps://chatgpt.com/backend-api/codexgpt-image-2autoautoautoautopng100 for jpeg and webpFor detailed parameter values, defaults, model-specific constraints, and CLI mapping, read references/openai-images-api-parameters.md.
Prefer the official API defaults unless the user request requires a specific option. Read the reference before choosing explicit model, size, quality, background, moderation, or output_format values.
Keep prompts explicit and production-oriented:
codex_gpt_image.py login --open-browser, or ask the user to run codex login, then retry.~/.codex/auth.json.The CLI sends Codex Images requests with:
POST https://chatgpt.com/backend-api/codex/images/generationsPOST https://chatgpt.com/backend-api/codex/images/editsAuthorization: Bearer <access token from ~/.codex/auth.json>gpt-image-2It parses the JSON Images response and writes returned base64 image payloads to local files.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.