image-hosting

Upload images to img402.dev and get a public URL. Free tier: 1MB max, 7-day retention, no auth. Use when the agent needs a hosted image URL — for sharing in messages, embedding in documents, posting to social platforms, or any context that requires a public link to an image file.

Security Scan

The skill does what it says: it contains only instructions to upload local image files to img402.dev using curl, and requests no credentials or installs — behavior is coherent with its description.

Purpose & Capability

Name/description (public image hosting) match the instructions: the SKILL.md shows curl commands to POST images to https://img402.dev/api/free and describes paid endpoints. Required binary (curl) is appropriate and proportional.

Instruction Scope

Instructions operate on local image files (read from provided paths) and upload them to an external CDN. This is expected for an image-hosting helper, but users should note that uploaded images become publicly accessible. The doc also mentions optional image tools (sips, ImageMagick) that are not required by the skill but are suggested for resizing.

Install Mechanism

No install spec and no code files (instruction-only) — lowest risk. The skill only requires curl to be present on PATH.

Credentials

No environment variables or credentials requested. Paid flow mentions an upload token obtained after a payment step, which is expected for a paid retention tier and not requested up-front by the skill.

Persistence & Privilege

always is false and the skill does not request persistent privileges or modify agent/system configs. Autonomous invocation is allowed (platform default) but not combined with any broad credentials or elevated privileges.

Assessment

This skill is coherent but consider privacy and trust: any file you upload becomes publicly accessible for the retention period (free tier: 7 days), so do not upload sensitive images. Verify you trust img402.dev (review their privacy/terms) before using. The free tier has a 1 MB size limit and 1,000 uploads/day; the SKILL.md suggests using sips/ImageMagick to resize images if needed. The paid flow refers to an external x402 payment/token process — treat that like any third‑party payment and verify legitimacy before paying. If you need long-term or private hosting, use a provider you control or a service with explicit access controls.

Image Hosting — img402

Upload an image to img402.dev and get a public URL. No account, no API key, no config.

Quick reference

# Upload (multipart)
curl -s -X POST https://img402.dev/api/free -F image=@/path/to/image.png

# Response
# {"url":"https://i.img402.dev/aBcDeFgHiJ.png","id":"aBcDeFgHiJ","contentType":"image/png","sizeBytes":182400,"expiresAt":"2026-02-17T..."}

Workflow

1. Get image: Use an existing file, or generate/download one.
2. Check size: Must be under 1MB. If larger, resize:

   sips -Z 1600 /path/to/image.png    # macOS — scale longest edge to 1200px
   convert /path/to/image.png -resize 1600x1600 /path/to/image.png  # ImageMagick
   

3. Upload:

   curl -s -X POST https://img402.dev/api/free -F image=@/path/to/image.png
   

4. Use the URL: The url field in the response is a public CDN link. Embed it wherever needed.

Constraints

• Max size: 1MB
• Retention: 7 days
• Formats: PNG, JPEG, GIF, WebP
• Rate limit: 1,000 free uploads/day (global)
• No auth required

Paid tier

For images that need to persist longer (1 year, 5MB max), use the paid endpoint at $0.01 USDC via x402:

# Step 1: Get an upload token (requires x402 payment)
POST https://img402.dev/api/upload/token
# → {"token": "a1b2c3...", "expiresAt": "..."}

# Step 2: Upload with the token
curl -s -X POST https://img402.dev/api/upload \
  -H "X-Upload-Token: a1b2c3..." \
  -F image=@/path/to/image.png

See https://img402.dev/blog/paying-x402-apis for details on x402 payment.