The skill is. Create a free AdAnt account to download the ZIP, and the original is public on GitHub, linked on this page. The images are not free to make, and AdAnt credits play no part: the Codex and Grok routes draw on your own subscription quota, and OpenRouter bills your account per image. The author estimates under ten cents an image on OpenRouter's default model. We did not measure that.

codex runs codex exec --json --sandbox workspace-write --skip-git-repo-check on your own Codex CLI, with the prompt on stdin and your login; it first runs codex login status and codex features list. grok runs grok -p with the prompt on the command line, --always-approve and --sandbox workspace, on your own Grok CLI and login; it checks only that auth.json exists and does not read it. openrouter makes HTTPS calls from Python with the apiKey in your config file. grok-bot and muse-native run nothing: illo.py generate refuses them, and an agent that really is Grok Bot or Muse's Blip calls its own built-in image tool under its own account. Illo reads no Codex or Grok credential.

It will not ask on a new install. Unless you choose a route, illo.py uses Codex if it is logged in, then Grok, then OpenRouter, so a CLI you keep for other work can pay for your images, and SKILL.md tells your agent not to name the route in chat. Plain init does not fix this: saying no to its Codex or Grok offer saves nothing, so even with an OpenRouter key stored, a logged-in Codex still goes first. Run init --backend with the route you want, as in the install steps. A failed Codex or Grok render then stops instead of moving to OpenRouter, unless --allow-paid-fallback is passed, which SKILL.md keeps for your explicit approval. There are two exceptions. A transparent cutout cannot run on Grok, so even with backend: grok it moves to Codex, or to OpenRouter if a key is set, which bills per image and prints only a note. And when your agent is itself Codex or Grok, SKILL.md tells it to pass its own --backend flag, which in illo.py beats your config, even though SKILL.md also says your config wins. We read this in the code and did not run these routes.

Both CLI routes start another agent told not to ask for confirmation, and grok also approves every action itself. codex runs with --sandbox workspace-write. For grok, a comment in illo.py says its workspace sandbox limits writes to the run folder, temp and ~/.grok, and that network stays open. We did not test either sandbox. Text from an article you illustrate can reach that agent, so use OpenRouter for pages you do not trust. Grok also puts the whole prompt on the command line, where other local users can see it in the process list.

illo.py calls openrouter.ai on that route only, including a cost lookup that uses your key when you build a gallery, and raw.githubusercontent.com for character packs. The style files tell your agent to fetch example images from raw.githubusercontent.com/tmchow/illo-skill on its main branch. snes.md also links two password-protected galleries on ht-ml.app for your agent to study, with the password in the file; nothing in the code opens them and we did not. repair-hermes-assets.sh, for the Hermes agent only, uses curl against one pinned commit and checks SHA-256. The Codex and Grok CLIs talk to their own vendors. In surprise mode your agent searches the web to verify quotes. We found no telemetry.

No. Only Blot ships. illo.py packs list, show, install and update download from a separate repository, tmchow/illo-characters, MIT, on its main branch, so our pinned commit does not cover them and no hash is checked. Upstream calls installs pinned, which means your local copy stays put until you update it. Your agent can read the catalog from that branch without asking, to match a character name you used or to check an installed pack for updates; SKILL.md has it update only on your yes. When we looked on 5 November 2026 it listed 57 packs, four by other authors whose credit lines the repo asks you to keep. We read its license and catalog, not the packs. A pack is a character.md and a reference image; nothing in one is executed, and pack-sharing.md tells your agent to treat it as data, but your agent still reads the text and the image goes to your image route, so run packs show first. Never accept a packsRepo setting or --repo address from someone else, because either can point anywhere.

It names no living artist. Three of the seventeen looks lean on a brand, and you can skip all three. bricks is a photoreal toy-brick set with minifigure-style figures. It never says LEGO, and tells your agent not to copy a trademarked minifigure or show brand logos. snes takes its name and part of its prompt from Nintendo's console, and tells your agent to avoid licensed icons such as Mario's blocks. sketchbook's prompt says like a New Yorker spot drawing, with no such note. Those notes sit outside the prompt text and are no guarantee of what a model returns, so look hard at any such image before it goes near a client or an ad. Two other words began as trade names but are used here for a technique: Risograph in the default riso look, and Claymation in clay's prompt.

The OpenRouter key sits in plain text in ~/.config/illo/config.yaml with mode 600, written by init at a hidden prompt, and goes only to openrouter.ai. SKILL.md tells your agent never to enter it, except to copy OPENROUTER_API_KEY in a throwaway cloud workspace where you set that secret. Prompts and reference images go to the route you use. Each run also writes the full prompt to manifest.jsonl beside the image, batches save your request word for word to request.txt under /tmp/illo, in a folder made with default permissions, and a gallery page shows the prompts. Check those before you share a gallery made from private text.

Almost. We read SKILL.md, every reference and style file, illo.py and the repair script line by line. diagram_route.py, a text classifier for choosing a diagram type, we scanned: it imports no network or process modules and reads only composition.md. We found no prompt telling a model to ignore a refusal; the one line saying do not refuse is about the word flowchart. We ran doctor and packs list from an installed copy, but not its image routes, because each needs an account or key of its own. It is someone else's code, so read it before you trust it.

Everything outside skills/illo, which the author's own installers leave out too: example art, evaluation images, tests, CI and plugin manifests. We also leave out the skill's own README.md, which installers do copy, because its links to those example folders would not resolve here. No script reads it, and SKILL.md and the reference files cover the rest of its setup. SKILL.md does point to its Cloud & CI line for seeding a key in a throwaway workspace, so in the ZIP that pointer leads nowhere: read skills/illo/README.md on GitHub. That line writes only apiKey, and from reading illo.py, generate then stops as out of date until you also run init --backend openrouter --no-key. We did not run it. Every file we ship is unchanged, including its NOTICE, which asks anyone redistributing it to credit Illo by Trevin Chow.

No. They are upstream's own examples from the illo repository, under its MIT license and NOTICE, shrunk to JPEG for this page. We did not generate them, and the repo does not say which image model made them. They show the Blot character, so what you get will depend on your route and prompt.

The skill's MIT license covers the skill, not your renders. Those depend on the terms of the image route you used and on the law where you publish. Characters you build are yours, and the NOTICE asks you to credit Illo by Trevin Chow if you build on Blot or its art. Packs from the community repo stay credited to their authors.

SKILL.md tells your agent not to talk about backends in chat, so read the backend field in manifest.jsonl to see what ran. It answers only to the word illo. Its default OpenRouter model is not in OpenRouter's public list and can 404; the fallback is in references/models.md. If the Grok CLI saves no file, illo.py takes the newest image in Grok's session folders from that run's start, which could belong to another Grok session running at the same time. Publishing a pack opens a public MIT-licensed pull request from your GitHub account, and the skill tells your agent to confirm that with you first.