htmlcsstoimage
Generates images from HTML/CSS or captures web page screenshots using the HTMLCSStoImage API.
Install this skill
Security score
The htmlcsstoimage skill was audited on Feb 12, 2026 and we found 49 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 81 | ```bash |
Template literal with variable interpolation in command context
| 114 | ```bash |
Template literal with variable interpolation in command context
| 138 | ```bash |
Template literal with variable interpolation in command context
| 156 | ```bash |
Template literal with variable interpolation in command context
| 172 | ```bash |
Template literal with variable interpolation in command context
| 184 | ```bash |
Template literal with variable interpolation in command context
| 204 | ```bash |
Template literal with variable interpolation in command context
| 216 | ```bash |
Template literal with variable interpolation in command context
| 228 | ```bash |
Template literal with variable interpolation in command context
| 238 | ```bash |
Template literal with variable interpolation in command context
| 256 | ```bash |
Template literal with variable interpolation in command context
| 280 | ```bash |
Curl to non-GitHub URL
| 56 | > bash -c 'curl -s "https://api.example.com" -H "Authorization: Bearer $API_KEY"' |
Curl to non-GitHub URL
| 82 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt"' |
Curl to non-GitHub URL
| 115 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt" --data-urlencode "css@/tmp/hcti_css.txt"' |
Curl to non-GitHub URL
| 139 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt" --data-urlencode "css@/tmp/hcti_css.txt" -d "google_fonts=Playfair D |
Curl to non-GitHub URL
| 157 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt"' |
Curl to non-GitHub URL
| 173 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "ms_delay=1500"' |
Curl to non-GitHub URL
| 185 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "selector=h1"' |
Curl to non-GitHub URL
| 205 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt" -d "device_scale=2"' |
Curl to non-GitHub URL
| 217 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "viewport_width=1200" -d "viewport_height=630"' |
Curl to non-GitHub URL
| 229 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "full_screen=true"' |
Curl to non-GitHub URL
| 239 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "block_consent_banners=true"' |
Curl to non-GitHub URL
| 257 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt"' | jq -r '.url' |
Curl to non-GitHub URL
| 263 | curl -s "https://hcti.io/v1/image/<your-image-id>?dl=1" --output image.png |
Curl to non-GitHub URL
| 281 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt"' | jq -r '.url' |
External URL reference
| 31 | 1. Sign up at [HTMLCSStoImage](https://htmlcsstoimage.com/) and create an account |
External URL reference
| 32 | 2. Go to your [Dashboard](https://htmlcsstoimage.com/dashboard) to get your User ID and API Key |
External URL reference
| 56 | > bash -c 'curl -s "https://api.example.com" -H "Authorization: Bearer $API_KEY"' |
External URL reference
| 65 | - `https://hcti.io/v1/image` |
External URL reference
| 82 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt"' |
External URL reference
| 88 | "url": "https://hcti.io/v1/image/abc123..." |
External URL reference
| 115 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt" --data-urlencode "css@/tmp/hcti_css.txt"' |
External URL reference
| 139 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt" --data-urlencode "css@/tmp/hcti_css.txt" -d "google_fonts=Playfair D |
External URL reference
| 153 | https://example.com |
External URL reference
| 157 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt"' |
External URL reference
| 169 | https://example.com |
External URL reference
| 173 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "ms_delay=1500"' |
External URL reference
| 185 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "selector=h1"' |
External URL reference
| 205 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt" -d "device_scale=2"' |
External URL reference
| 217 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "viewport_width=1200" -d "viewport_height=630"' |
External URL reference
| 229 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "full_screen=true"' |
External URL reference
| 239 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "url@/tmp/hcti_url.txt" -d "block_consent_banners=true"' |
External URL reference
| 257 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt"' | jq -r '.url' |
External URL reference
| 263 | curl -s "https://hcti.io/v1/image/<your-image-id>?dl=1" --output image.png |
External URL reference
| 281 | bash -c 'curl -s "https://hcti.io/v1/image" -X POST -u "${HCTI_USER_ID}:${HCTI_API_KEY}" --data-urlencode "html@/tmp/hcti_html.txt"' | jq -r '.url' |
External URL reference
| 287 | Original: https://hcti.io/v1/image/<your-image-id> |
External URL reference
| 288 | Thumbnail: https://hcti.io/v1/image/<your-image-id>?width=200&height=200 |
External URL reference
| 298 | "url": "https://hcti.io/v1/image/be4c5118-fe19-462b-a49e-48cf72697a9d" |