Agent skill · security · jeremylongshore
ideogram-security-basics
Harden an Ideogram integration across credentials, untrusted media, content safety, copyright controls, storage, and tenant authorization. Use when reviewing a threat model or implementing security controls. Trigger with "secure Ideogram", "audit Ideogram image uploads", or "review Ideogram content safety".
Why this skill is useful
Provides specific procedures for securing Ideogram API keys and preventing exposure that the AI wouldn't reliably generate on its own.
What it needs
Requires ideogram account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Ideogram Security Boundary Overview Threat-model the full image lifecycle rather than only the API key. Protect server-side authority, uploaded bytes, prompt and structured-description content, safety decisions, copyright settings, temporary vendor URLs, durable assets, and cross-tenant access. Prerequisites Data classification, tenant model, rights policy, moderation owner, and retention schedule. Architecture showing upload, API, queue, webhook, download, storage, and publishing boundaries. Incident paths for credential exposure, unsafe output, malicious media, and unauthorized asset access. Current Contract Ideogram uses a server-side Api-Key. Returned items expose isimagesafe; unsafe items can have an empty URL. V4 supports enablecopyrightdetection, and request plus organization settings combine as an OR gate. Generated URLs expire and must not become the application's authorization layer. Authentication Store IDEOGRAMAPIKEY in a managed secret store and send it only to https://api.ideogram.ai. Authenticate application users separately, authorize each operation and object by tenant, and issue application-owned short-lived download access after durable storage. Instructions 1. Map every trust boundary and classify keys, prompts, structured prompts, uploads, masks, generated assets, metadata, and logs. 2. Keep paid API calls behind a server-side policy enforcement point with tenant authentication, authorization, budgets, and rate controls. 3. Validate media signatures, types, dimensions, byte limits, decompression behavior, and malware policy before forwarding. 4. Apply rights, content-safety, and copyright-detection policy before generation and again before publication. 5. Check isimagesafe, validate download type and size, store under opaque tenant-scoped keys, and discard vendor URLs. 6. Encrypt retained objects, restrict service identities, log content-free decisions, and enforce deletion. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/ideogram-security-basics