freestylefly/awesome-gpt-image-2
C2Prompt as Code | GPT Image 2 / 2.5 提示词与案例库，530+ 个案例、20+ 套工业级模板与可复用 Skills，新增 2.5 同提示词对比专区，附完整提示词与生成记录，持续更新。
★ 33k+ · freestylefly/awesome-gpt-image-2 source on GitHub · this plugin in the registry
freestylefly/awesome-gpt-image-2 is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It decodes base64 payloads, reads credential-class env vars.
A skill, not an installable plugin — ships SKILL.md with no plugin manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| decodes base64 payloads | base64_decode | ×1 in authored code, e.g. api/_lib/community.js:249 |
| reads credential-class env vars | token_env | ALIPAY_PRIVATE_KEY, ALIPAY_PUBLIC_KEY, APIMART_API_KEY, GOOGLE_ANALYTICS_CLIENT_SECRET, GOOGLE_ANALYTICS_PRIVATE_KEY, GOOGLE_ANALYTICS_REFRESH_TOKEN |
Outbound domains
watcha.cn openapi-sandbox.dl.alipaydev.com openapi.alipay.com gpt-image2.canghe.ai analyticsdata.googleapis.com
Environment variables it reads
APP_URL GA4_PROPERTY_ID ALIPAY_APP_ID ALIPAY_PRIVATE_KEY ALIPAY_PUBLIC_KEY ALIPAY_SELLER_ID ALIPAY_NOTIFY_ENABLED ALIPAY_NOTIFY_URL COMMUNITY_ALIPAY_NOTIFY_URL STRIPE_SECRET_KEY
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.