Gives text-only models (DeepSeek, GLM) the ability to read pasted images, converting them to structured JSON (OCR, layout, semantics) via ten vision backends.
A well-engineered, easily removable vision bridge with sensible fallbacks, but it needs network access and at least one vision credential, and it reuses your other CLIs' logins with permission at install time.
ModLens targets models that cannot see images, such as DeepSeek's chat models and GLM-5.3, inside DeepSeek Harness (dsh), Claude Code, Codex, OpenCode and Pi. When an image path, URL or paste placeholder appears in the conversation and the active model cannot see it, the skill's hard rule tells the agent to run ModLens rather than build its own OCR with PIL or tesseract. A modlens guard check first verifies the active model actually lacks native vision, so vision-capable models (including GLM-5.3-Flash) are left to read images themselves.
Under the hood it tries up to ten vision sources: six built-in providers (a free Gemini API key is the recommended default, plus OpenAI-compatible endpoints and Anthropic) and four local agent-CLI logins it can reuse (Antigravity's free agy CLI, a signed-in Claude Code, Codex, Pi or Kimi Code), asking permission before reusing each one. Comma-separated API keys rotate automatically on auth, rate-limit or quota failures. Install is one command for DeepSeek Harness or copying one skill folder for other hosts, with no hooks, wrappers or proxy daemon, so removal is just deleting the folder. The skill ships two launcher scripts (run.sh, run.ps1) and the repo has 9 eval files. A sibling project, ModSearch, adds web and X search the same way.
One skill at about 5.4 KB with 5 references and 2 launcher scripts, but the repository carries 9 eval files and a documented ten-source provider fallback chain.
Counted from the repository file tree. How we score depth.
This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.
Bash (unrestricted shell); the skill uses it to run the bundled launcher and the modlens CLI.skills/modlens/SKILL.md:5agy agent with --dangerously-skip-permissions (documented in docs/security.md); the prompt limits it to reading one image copy in a throwaway directory, which the docs say is not an OS sandbox.src/providers/antigravity.ts:44A vision-bridge skill that gives text-only models image reading by sending images to a vision engine you configure, with unrestricted Bash pre-approved for running its pinned CLI. It can reuse API keys or logins held by other agent CLIs only after a per-harness yes, can recover pasted images from your agent session history, and one provider launches Google's agy with permission checks skipped. Everything is documented in the repo's security notes, but the images you read leave your machine for whichever provider you pick.
curl -fsSL https://antigravity.google/cli/install.sh | bash (macOS/Linux) as one optional vision engine.INSTALL.md:206npx --yes --package @liustack/modlens@3.27.2 / bunx (pinned), and the providers drive external CLIs (agy, claude, codex, kimi, pi, opencode).skills/modlens/scripts/run.sh:199The repository (158 files) on Oct 29, 2026. Not a full review: we read 2 of 99 code files; it relies on code outside the repository: published npm package @liustack/modlens@3.27.2 (assumed to match src/, but the tarball itself is not in our files); agy (Antigravity CLI), claude, codex, kimi, pi and opencode CLIs driven by the providers; most of the 99 listed code files were searched for process, credential-path and network use but not read in full; the 114 KB dsh/index.js plugin and dsh/client.js were not read.
NVIDIA SkillSpector static scan: 140 pattern hits (MCP Rug Pull 53, Privilege Escalation 23, Supply Chain 17, Data Exfiltration 14, Tool Misuse 10, Rogue Agent 6). SkillSpector's 140 hits are mostly test fixtures and docs: SSRF guard tests (169.254.169.254, /etc/passwd, metadata hostnames) that verify the downloader blocks them, 'keychain' wording in the dsh settings UI, 'rm -rf /tmp/modlens-src' in install docs, 'git reset --hard' in the release script, and unpinned npx mentions in docs. The real points are the agy --dangerously-skip-permissions call, the curl|bash install suggestion and the reuse of other CLIs' credentials, all documented in INSTALL.md and docs/security.md.
A review, not a certification. Skills change after we check them — read the files before installing.
MIT — commercial use allowed, with no warranty; use of upstream vision engines (Antigravity, Gemini, OpenAI, Anthropic) is subject to their own terms.
Not really. It processes one pasted image per request on demand; it is not a standing or scheduled process.
Google Labs' 16 skills for the Stitch design tool: generate screens, extract design systems, and convert Stitch designs to React, React Native and more.
It is a vision bridge skill that gives text-only models like DeepSeek and GLM-5.3 the ability to read pasted images, returning structured JSON (OCR text, layout regions, semantics) instead of raw pixels.
For DeepSeek Harness, run npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.27.2. For Claude Code, Codex, OpenCode or Pi, copy the single skills/modlens folder into your skills directory; no hooks or config changes are needed.
Not necessarily. ModLens can reuse an existing signed-in Claude Code, Codex, Pi or Kimi Code CLI, or the free Antigravity agy CLI, with your permission. Otherwise a free Gemini API key is the recommended fallback.
It only activates for images it cannot already see and asks before reusing another CLI's login. Any pasted image is sent to whichever vision backend is active, so treat that the same as sending an image to that provider directly.