Ecdysales

Quick product image processing: add price sticker + watermark + logo. Use when user sends `$price:` with an image. Minimal context, runs fast.

Security Scan

The skill's code, declared requirements, and runtime instructions are coherent with a local ImageMagick-based image sticker/watermark/branding tool — nothing in the bundle indicates hidden networking or unrelated credential access.

Purpose & Capability

Name/description (add price sticker + watermark + logo) matches the files and required binaries (ImageMagick tools convert/identify, bc, python3). Provided scripts implement exactly that functionality (setup, run entrypoint, make-product image processor). No unrelated credentials, services, or installers are requested.

Instruction Scope

SKILL.md instructs the agent to run scripts/run.sh with a price and image only; the scripts themselves perform only local file operations and ImageMagick processing. Two cautionary points: (1) ImageMagick historically has had vulnerabilities when processing untrusted images (delegates, encoded payloads); the skill claims 'no network' but that does not eliminate ImageMagick-specific risks. (2) The scripts rely on careful quoting (SKILL.md insists on single quotes around prices). Some command-line expansions in run.sh/make-product.sh are brittle and could mishandle specially crafted price strings or filenames if the caller doesn't follow the quoting rules — SKILL.md mitigates this but the implementation is not fully hardened.

Install Mechanism

No remote download/install artifact is embedded in the registry metadata; this is primarily an instruction-and-scripts package. setup.sh can optionally install packages via the system package manager (apt/dnf/pacman/brew) — expected for this type of tool and done via standard package managers, not arbitrary URLs.

Credentials

The skill requires only local binaries and does not declare or require any secrets or config paths. It optionally reads ECDYSALES_MEDIA_DIR to locate recent images (defaulting to $HOME/Pictures/incoming) — this is reasonable for a media-focused tool but is worth noting because run.sh will search that directory by default.

Persistence & Privilege

The skill does not request permanent/always-on inclusion and does not modify other skills or global agent configuration. Output is written to a local output/ directory; there is no database or external telemetry. setup.sh can create output/ and mark scripts executable — normal install-time actions.

Assessment

This package appears to do what it says: local image processing with ImageMagick. Before installing, consider: 1) ImageMagick risk — processing attacker-crafted images can sometimes lead to code execution or unexpected behavior; only run the skill on images from trusted sources or sandbox it. 2) Quoting fragility — the scripts require callers to use single quotes around prices (e.g., '$299'); failing to follow that can change how the shell interprets the argument. If you plan to let an agent invoke this automatically, ensure the agent supplies correctly quoted arguments and that the agent's runtime isolates execution (or restricts which input folders it can read). 3) setup.sh may auto-install system packages via sudo if you run it with --install — review and approve those package manager actions. 4) The tool will look in ~/Pictures/incoming by default for the latest image; if you dislike that, set ECDYSALES_MEDIA_DIR to a safe folder. Overall: functionally coherent but apply usual caution for processing untrusted images and ensure proper quoting/agent sandboxing.

You add price stickers to product images. Nothing else.

When to act

A message has $price: AND an image was attached.

What to do

1. Run: scripts/run.sh --latest '<price>' [flags] — use single quotes
2. The script prints ✅ Done: <output-path> — save that path
3. Reply with the output image to the user
4. Say nothing else.

⚠️ Single quotes for prices: '$1300' not "$1300" — double quotes break $. ⚠️ MEDIA: line must be FIRST in your reply. Without it, nothing is sent.

Skip flags

User says	Add to command
no-logo	--no-logo
no-watermark	--no-watermark
sticker-only	--sticker-only

Errors

Situation	Reply
$price: but no image	📸 Send an image with your price
Image but no $price:	💰 Include $price: $XXX
Processing failed	❌ Something broke, try again

Safety

• No network access. All processing is local via ImageMagick. No external APIs, no data leaves the machine.
• No shell injection. Prices are passed to ImageMagick caption:, not interpolated into shell commands. Single quotes prevent variable expansion.
• Read-only input. Source images are never modified. Output goes to a separate output/ directory.
• No persistent state. No databases, no config files written at runtime, no tracking.
• Worst case: A malformed image causes ImageMagick to error out. The script catches this and reports failure.
• Cleanup: Output files should be cleaned periodically (e.g. cron job) to avoid disk fill.

Version History

Version	Date	Changes
1.0.0	2026-03-27	Initial release

Everything else

NO_REPLY. Don't chat. Don't explain. Just process or stay quiet.