New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Ideogram Security Basics

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization.

MITAuto-check passedBackend & APIs

Install Ideogram Security Basics

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill ideogram-security-basics -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace ideogram-security-basics --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/ideogram-security-basics .claude/skills/ideogram-security-basics && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
ideogram-security-basics
GitHub stars
2.8k
Token cost
~1.2k tokens
SKILL.md length
512 words
Files
2 (incl. references)
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization.

  • Works in 7 steps: Map every trust boundary and classify… → Keep paid API calls behind a server-side… → Validate media signatures, types,… → …
  • Reviewing a threat model
  • SKILL.md covers Overview, Prerequisites, Current Contract and Authentication, plus 8 more sections
  • Reaches api.ideogram.ai; needs IDEOGRAM_API_KEY

What it does

Ideogram Security Basics is an agent skill from jeremylongshore/tons-of-skills-marketplace. Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization. Use when reviewing a threat model or implementing security controls. Trigger with "secure Ideogram", "audit Ideogram image uploads", or "review Ideogram content safety".

Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/official-docs.md`). Compatibility notes: Designed for Claude Code; security review defaults to repository and fixture evidence

It sits in Backend & APIs, covering Threat modeling and Authorization and RBAC. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • Reviewing a threat model
  • Implementing security controls
  • With secure Ideogram
  • Audit Ideogram image uploads

Example prompts

  • “secure Ideogram”
  • “audit Ideogram image uploads”
  • “review Ideogram content safety”
  • “/ideogram-security-basics”

Requirements

  • A credential in IDEOGRAM_API_KEY
  • Compatibility (from SKILL.md): Designed for Claude Code; security review defaults to repository and fixture evidence
  • Pre-approved tools (allowed-tools): Read, Glob, Grep, Write, Edit

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Map every trust boundary and classify keys, prompts, structured prompts, uploads, masks, generated assets, metadata, and logs.
  2. Keep paid API calls behind a server-side policy enforcement point with tenant authentication, authorization, budgets, and rate controls.
  3. Validate media signatures, types, dimensions, byte limits, decompression behavior, and malware policy before forwarding.
  4. Apply rights, content-safety, and copyright-detection policy before generation and again before publication.
  5. Check is_image_safe, validate download type and size, store under opaque tenant-scoped keys, and discard vendor URLs.
  6. Encrypt retained objects, restrict service identities, log content-free decisions, and enforce deletion.
  7. Test key rotation, unsafe output, cross-tenant denial, malicious upload, expired URL, and object deletion.

What it can do on your machine

Read from SKILL.md and the folder at commit 80f86df. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Glob
    • Grep
    • Write
    • Edit

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • api.ideogram.ai

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • IDEOGRAM_API_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code; security review defaults to repository and fixture evidence

    From compatibility in the SKILL.md frontmatter.

Context cost

Ideogram Security Basics loads about 1.2k tokens when it runs, and up to ~1.8k if it reads all its reference files. Until then it costs about 83 tokens; SKILL.md has 512 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~83
When it runs · the whole SKILL.md, loaded when a task matches
~1.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit 80f86df, republished under its MIT licence (© jeremylongshore). 512 words, ~1,187 tokens.

Download SKILL.mdSave it as .claude/skills/ideogram-security-basics/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
ideogram-security-basics
description
Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization. Use when reviewing a threat model or implementing security controls. Trigger with "secure Ideogram", "audit Ideogram image uploads", or "review Ideogram content safety".
allowed-tools
Read, Glob, Grep, Write, Edit
compatibility
Designed for Claude Code; security review defaults to repository and fixture evidence
argument-hint
<application-boundary> <data-class> <environment>
version
1.11.0
license
MIT
author
Jeremy Longshore <jeremy@intentsolutions.io>
tags
saas, ideogram, security
model
inherit
effort
high

Ideogram Security Boundary

Overview

Threat-model the full image lifecycle rather than only the API key. Protect server-side authority, uploaded bytes, prompt and structured-description content, safety decisions, copyright settings, temporary vendor URLs, durable assets, and cross-tenant access.

Prerequisites

  • Data classification, tenant model, rights policy, moderation owner, and retention schedule.
  • Architecture showing upload, API, queue, webhook, download, storage, and publishing boundaries.
  • Incident paths for credential exposure, unsafe output, malicious media, and unauthorized asset access.

Current Contract

Ideogram uses a server-side Api-Key. Returned items expose is_image_safe; unsafe items can have an empty URL. V4 supports enable_copyright_detection, and request plus organization settings combine as an OR gate. Generated URLs expire and must not become the application's authorization layer.

Authentication

Store IDEOGRAM_API_KEY in a managed secret store and send it only to https://api.ideogram.ai. Authenticate application users separately, authorize each operation and object by tenant, and issue application-owned short-lived download access after durable storage.

Instructions

  1. Map every trust boundary and classify keys, prompts, structured prompts, uploads, masks, generated assets, metadata, and logs.
  2. Keep paid API calls behind a server-side policy enforcement point with tenant authentication, authorization, budgets, and rate controls.
  3. Validate media signatures, types, dimensions, byte limits, decompression behavior, and malware policy before forwarding.
  4. Apply rights, content-safety, and copyright-detection policy before generation and again before publication.
  5. Check is_image_safe, validate download type and size, store under opaque tenant-scoped keys, and discard vendor URLs.
  6. Encrypt retained objects, restrict service identities, log content-free decisions, and enforce deletion.
  7. Test key rotation, unsafe output, cross-tenant denial, malicious upload, expired URL, and object deletion.

Tool Discipline

Use Read, Glob, and Grep to inspect code, policies, infrastructure, and fixtures. Use Write and Edit for approved hardening and tests. Do not open customer media, rotate production keys, weaken policy, or run live generation without authority.

Show full SKILL.md (214 more words)Show less

Approval Boundaries

Require accountable approval for sensitive-image processing, copyright-control changes, external publication, retention exceptions, identity or role changes, key rotation, and production rollout. Fail closed when rights or tenant ownership is ambiguous.

Error Handling

  • Revoke and rotate an exposed key; deleting a log line alone is insufficient.
  • Treat unsafe output as a policy result and never auto-rewrite prompts to bypass it.
  • Reject redirects, unexpected media types, oversized bodies, and storage keys outside the authorized tenant prefix.

Output

Return boundaries reviewed, controls present or missing, risk severity, evidence locations, tests, owners, remediation, deployment state, and rollback. Exclude credentials, content, URLs, and exploitable secret locations.

Examples

  • Deny a browser request that attempts to call Ideogram directly with a shared key.
  • Persist an approved image to a tenant-owned object key and expose only an application-signed download.

Validation

Run secret scanning, authorization tests, media parser fixtures, safety branches, storage isolation, deletion, and key-rotation rehearsal. Confirm logs and traces contain no key, prompt, URL, or binary content.

Resources

  • Current first-party evidence map — use the dated endpoint, webhook, billing, team, and training links as the contract index for this workflow.
  • Recheck the endpoint-specific page and current OpenAPI description before relying on an enum, limit, beta feature, or lifecycle claim.
  • Record live observations as environment-specific evidence, not as universal vendor guarantees.

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/.curated/ideogram-security-basics of jeremylongshore/tons-of-skills-marketplace.

  • SKILL.md
  • references/official-docs.md

Open the folder on GitHubat commit 80f86df

Compare with similar skills

Ideogram Security Basics next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Ideogram Security Basics compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Ideogram Security Basics this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.2kAutomated safety check: PassMIT
Security Threat Modelmajiayu000/spellbook287—~561Automated safety check: PassMIT
Entry Point Analyzeralt-research2/SolidityGuard104—~959Automated safety check: PassCustom licence
Defender For Endpointvinayaklatthe/microsoft-security-skills175—~2.3kAutomated safety check: PassMIT
Implementing Device Posture Assessment In Zero Trustmukul975/Anthropic-Cybersecurity-Skills34k—~4.1kAutomated safety check: PassApache-2.0
Security And Hardeningdzhalaevd/Donatello135—~5.1kAutomated safety check: NotesApache-2.0

Similar skills

  • Security Threat Model

    majiayu000/spellbook

    Threat-model product features, APIs, data flows, secrets, permissions, supply-chain changes, auth boundaries, and risky code paths before or during implementation.

    287 GitHub stars~561 tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Entry Point Analyzer

    alt-research2/SolidityGuard

    Analyzes Solidity contract entry points to map attack surface.

    104 GitHub stars~959 tokensUpdated 3 mo ago
    Backend & APIsAuto-check passed

  • Defender For Endpoint

    vinayaklatthe/microsoft-security-skills

    Guidance for Microsoft Defender for Endpoint (MDE) — enterprise endpoint security with next-gen AV, EDR, attack surface reduction (ASR), Defender Vulnerability Management, automated investigation…

    175 GitHub stars~2.3k tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • Implementing Device Posture Assessment In Zero Trust

    mukul975/Anthropic-Cybersecurity-Skills

    Implements device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that…

    34k GitHub stars~4.1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

  • Security And Hardening

    dzhalaevd/Donatello

    Review or harden security-sensitive behavior involving authentication, authorization, secrets, sessions, untrusted input, sensitive data, or trust boundaries.

    135 GitHub stars~5.1k tokensUpdated 6 days ago
    SecurityAuto-check: notes

  • Audit Recon

    ccashwell/evm-cortex

    A skill your agent uses when performing initial audit reconnaissance.

    131 GitHub stars~1.5k tokensUpdated 10 days ago
    Backend & APIsAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated yesterday
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated yesterday
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Ideogram Security Basics

What does Ideogram Security Basics do?

Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization. Ideogram Security Basics is an agent skill from jeremylongshore/tons-of-skills-marketplace. Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization.

When should I use Ideogram Security Basics?

Ideogram Security Basics fits situations like: reviewing a threat model; implementing security controls; with secure Ideogram; audit Ideogram image uploads.

How do I install Ideogram Security Basics in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill ideogram-security-basics -a claude-code`. Or copy the skill folder (skills/.curated/ideogram-security-basics in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/ideogram-security-basics in your project. Claude Code loads it when a task matches its description.

How do I install Ideogram Security Basics in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill ideogram-security-basics -a codex`. Or copy the skill folder (skills/.curated/ideogram-security-basics in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/ideogram-security-basics in your project. Codex loads it when a task matches its description.

Can I use Ideogram Security Basics in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill ideogram-security-basics -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/ideogram-security-basics, .gemini/skills/ideogram-security-basics, .github/skills/ideogram-security-basics and .opencode/skills/ideogram-security-basics in your project.

What does Ideogram Security Basics need to run?

Going by SKILL.md and its folder, Ideogram Security Basics needs credentials named IDEOGRAM_API_KEY. Our summary lists: A credential in IDEOGRAM_API_KEY. Its frontmatter pre-approves these tools: Read, Glob, Grep, Write, Edit. Compatibility (from SKILL.md): Designed for Claude Code; security review defaults to repository and fixture evidence.

Does Ideogram Security Basics access the network?

SKILL.md names 1 domain. In commands or code: api.ideogram.ai; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Ideogram Security Basics safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Ideogram Security Basics use?

Ideogram Security Basics is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Ideogram Security Basics use?

About 1.2k tokens (SKILL.md is roughly 4.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 622 tokens, read only when the agent opens those files.

What are the alternatives to Ideogram Security Basics?

Skills that share tags, products or a category with Ideogram Security Basics: Security Threat Model (majiayu000/spellbook, 287 stars), Entry Point Analyzer (alt-research2/SolidityGuard, 104 stars), Defender For Endpoint (vinayaklatthe/microsoft-security-skills, 175 stars) and Implementing Device Posture Assessment In Zero Trust (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Ideogram Security Basics?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,825 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 9, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.