
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
prompt-to-asset
Advanced tools
Prompt enhancer + asset pipeline for developers. One brief → a validated bundle (iOS AppIconSet, Android adaptive, PWA, favicon, OG, visionOS) via routed image models. Three modes: inline_svg (zero-key), external_prompt_only (paste into your subscription)
One brief → a validated, multi-platform asset bundle. Prompt enhancer + asset pipeline for developers. Works in Claude Code, Cursor, Windsurf, Codex, Gemini CLI, Cline, VS Code, and standalone.
# Zero-key, one-liner
npx prompt-to-asset init
# Or install globally
npm i -g prompt-to-asset
p2a doctor
One brief + optional brand.json → every asset a modern app needs:
AppIcon.appiconset (14 sizes + 1024 marketing, opaque), iOS 18 dark / tinted variants.192, 512, 512-maskable (80 % safe zone) + manifest.webmanifest + <head> snippet..ico, icon.svg with prefers-color-scheme: dark, apple-touch-icon.png.flutter_launcher_icons.yaml + 1024 master.LaunchScreen-2732.png, Android mipmap-*dpi/splash.png, PWA splash-1200.png.Plus: logos, illustrations, hero banners, sticker / transparent marks, icon packs. Sprite sheets and 9-slice via the CLI for game devs.
| Mode | Keys required | Best for | How |
|---|---|---|---|
inline_svg | none | logos, favicons, icons, simple app icons | Server returns a tight SVG-authoring brief; your MCP host (Claude / Cursor) writes the <svg> inline, then asset_save_inline_svg writes it to disk and runs the platform fan-out. |
external_prompt_only | none | you already pay for ChatGPT / Midjourney / Ideogram / Google AI Studio / Recraft | Server returns the dialect-correct prompt + paste-target URLs. You generate in your subscription, save the file, then call asset_ingest_external to run matte → vectorize → validate. |
api (free) | none | automation, no paid key | Routes to Pollinations (zero signup), Hugging Face Inference (free HF_TOKEN), Cloudflare Workers AI (free 10k neurons/day), or Stable Horde (anonymous queue). |
api (paid) | one of OPENAI_API_KEY, IDEOGRAM_API_KEY, RECRAFT_API_KEY, BFL_API_KEY, GEMINI_API_KEY, STABILITY_API_KEY, LEONARDO_API_KEY, FAL_API_KEY | full-fidelity, rate-limit-free | Server calls the routed provider → matte → vectorize → export → tier-0 validate → content-addressed AssetBundle. |
p2a doctor tells you which modes are live in your current environment.
Devs ship apps. Apps need brand assets. Two obstacles:
This tool does for dev assets what paid prompt-enhancer tools do for designer prompts — free, scoped to dev-asset surfaces, routed across every model.
# Per project (keeps your toolchain reproducible)
npm i -D prompt-to-asset
# Global (recommended for CLI use)
npm i -g prompt-to-asset
# Zero install (every command works)
npx prompt-to-asset <cmd>
# Claude Code
claude mcp add prompt-to-asset -- p2a
# Cursor / VS Code / Windsurf — edit .cursor/mcp.json / .vscode/mcp.json
# "prompt-to-asset": { "command": "p2a" }
# Codex / Gemini CLI
# Already generated in .codex/config.toml / gemini-extension.json
p2a init scaffolds a brand.json tuned to your framework (Next.js, Expo, Flutter, Xcode, Android, Astro, …) and prints the exact registration command for your IDE.
npx prompt-to-asset doctor # what's on, what's missing, ranked best → worst
npx prompt-to-asset init # scaffold brand.json + register MCP server
npx prompt-to-asset pick # interactive model picker: asset type + constraints → ranked route
Then, in Claude Code / Cursor / Windsurf:
Generate a favicon bundle for my app called Forge. Use
brand.json.inline_svgmode.
Or standalone, from a master PNG you already have:
npx prompt-to-asset export path/to/master.png --platforms all --app-name "Forge"
# → writes iOS AppIconSet, Android adaptive, PWA, favicon.ico, OG, visionOS scaffold, Flutter yaml
redact() filter that scrubs common key patterns (OpenAI sk-…, Google AIza…, Anthropic sk-ant-…, Bearer …, ?key=…, Replicate r8_…, Hugging Face hf_…).image_path / output_dir inputs are resolved through symlinks and rejected if they escape the project cwd + output dir + cache dir. Widen with P2A_ALLOWED_PATHS=/path1:/path2 if your pipeline writes elsewhere.<script>, <foreignObject>, on*= handlers, javascript: URIs, external <image href> / <use href>, CSS @import over the network — all rejected unconditionally. The check runs even without SVGO installed.P2A_MAX_SPEND_USD_PER_RUN=5.00 to cap any single tool call. Pre-flight cost estimate (best-effort from published pricing) refuses to call if over. Free-tier routes are always $0.MIT.
FAQs
Prompt enhancer + asset pipeline for developers. One brief → a validated bundle (iOS AppIconSet, Android adaptive, PWA, favicon, OG, visionOS) via routed image models. Three modes: inline_svg (zero-key), external_prompt_only (paste into your subscription)
We found that prompt-to-asset demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.