stock-images

Security Rules

• NEVER display API keys in your output
• NEVER echo full curl commands that contain API keys
• Pixabay limitation: Pixabay requires the API key as a URL query parameter, which is visible in process lists (ps aux). Be aware of this inherent API limitation. Never display the full Pixabay curl command in output.
• Only download from allowed domains:
  • images.pexels.com
  • images.unsplash.com, plus.unsplash.com
  • pixabay.com, cdn.pixabay.com
• All URLs MUST use HTTPS
• After downloading, check file size — alert if > 10MB
• For Unsplash downloads, use the links.download URL (not urls.raw) to comply with Unsplash API TOS (triggers download count)

Non-Activation

Do NOT activate this skill when:

• Discussing image components (<img>, next/image, etc.)
• AI image generation is requested (that is a different skill)
• Referencing existing images already in the project