Skip to content
Back to skills

Upload Photo

BSecurity

upload a photo/image/screenshot, host an image, get a public image URL, put images on Vercel Blob, embed images in a PR/comment/doc. Upload local images to Vercel Blob and print public URLs.

  • 6,639 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 2, 2026
ai-agentsbashnodegit

Security analysis

B88/100
  • criticalSends environment variables or credentials to an external URL

Pro scans all 2 files and shows the line behind each finding

Scanned September 2, 2026

npx -y skills add Devin-AXIS/iPolloWork --skill upload-photo --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Upload Photo?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Upload Photo
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/devin-axis-upload-photo/badge)](https://www.skillsdirectory.com/skills/devin-axis-upload-photo)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: upload-photo
description: upload a photo/image/screenshot, host an image, get a public image URL, put images on Vercel Blob, embed images in a PR/comment/doc. Upload local images to Vercel Blob and print public URLs.
---

# Skill: upload-photo

Upload local image files to Vercel Blob and return public URLs for sharing.

## When to use

Use whenever an image or screenshot needs a public URL, including PR comments, docs, and sharing.

## Requires

`BLOB_READ_WRITE_TOKEN` must be set in the environment. If it is missing, use the `get-env-var` skill to fetch it from Infisical:

```bash
export BLOB_READ_WRITE_TOKEN="$(infisical secrets get BLOB_READ_WRITE_TOKEN --plain --silent)"
```

## Upload

Run the bundled script from the repo root:

```bash
node .opencode/skills/upload-photo/scripts/upload.mjs <file.png> [more files...] [--prefix <path/prefix>] [--stable]
```

It prints one public URL per line (`https://<store>.public.blob.vercel-storage.com/...`). `--prefix` defaults to `uploads/<YYYY-MM-DD>`. By default Vercel Blob appends a random suffix to the pathname for collision safety; `--stable` disables that (`x-add-random-suffix: 0`) for deterministic URLs, so overwrites are possible.

## Embed

Use Markdown:

```markdown
![alt](url)
```

Or HTML for size control in GitHub comments:

```html
<img src="url" width="700">
```

## Rules

- Never log `BLOB_READ_WRITE_TOKEN`.
- The store is public; do not upload anything sensitive.
- Prefer PNG, JPEG, or WebP images.

Files in this skill

  • SKILL.md1.5 KB
  • scripts/upload.mjs3.3 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.