freestylefly/awesome-gpt-image-2
C2Prompt as Code | GPT-Image2 工业级提示词引擎与模板库，470+ 个案例逆向工程，20+ 套工业级模板，并提炼出Skills，持续更新中
★ 11k+ · freestylefly/awesome-gpt-image-2 source on GitHub · this plugin in the registry
freestylefly/awesome-gpt-image-2 is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It decodes base64 payloads, starts a network server, reads credential-class env vars.
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| decodes base64 payloads | base64_decode | ×1 src, e.g. api/_lib/community.js:249 |
| starts a network server | net_server | ×1 src, e.g. scripts/alipay-webpay-sandbox-server.mjs:146 |
| reads credential-class env vars | token_env | ALIPAY_PRIVATE_KEY, ALIPAY_PUBLIC_KEY, CIYUAN_API_KEY, GOOGLE_ANALYTICS_CLIENT_SECRET, GOOGLE_ANALYTICS_PRIVATE_KEY, GOOGLE_ANALYTICS_REFRESH_TOKEN |
Outbound domains
watcha.cn ciyuan.today www.googleapis.com openapi-sandbox.dl.alipaydev.com openapi.alipay.com gpt-image2.canghe.ai analyticsdata.googleapis.com
Environment variables it reads
APP_URL GA4_PROPERTY_ID GOOGLE_ANALYTICS_CLIENT_ID GOOGLE_ANALYTICS_CLIENT_SECRET CIYUAN_API_KEY CODEX_HOME CLAUDE_HOME AGENTS_HOME VITE_SUPABASE_URL SUPABASE_URL
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.