feat: add kavel plugin 0.0.1

[hanshs474]

Plugin Submission

Plugin information

• Author: hanshs474
• Plugin name: kavel
• Version: 0.0.1
• Source repository: https://github.com/hanshs474/kavel-dify-plugin
• Contact: open a GitHub issue at the source repository

Submission type

• New plugin
• Version update

What changed

Adds Kavel, a tool plugin for image generation and photo editing that needs no API key and no account. Most image plugins require a provider key before they do anything; this one calls Kavel's anonymous tier, so the tools run the moment the plugin is installed. credentials_for_provider is empty and _validate_credentials is a no-op by design.

Two tools:

• generate_image — prompt in, image URL out, with an aspect-ratio select
• edit_image — change one thing in a photo (hairstyle, outfit, expression, background) and keep the face

The edit_image LLM description carries the rule that decides whether these edits work at all: the prompt must name what stays, not only what changes, because anything left unsaid is fair game for the model.

The free tier is stated rather than discovered: a signed-out caller is granted 15 credits, generate_image spends 5 and edit_image spends 15, with a per-IP ceiling of 30 a day. Output is 1K and watermarked. Video is deliberately not exposed — the cheapest clip is 40 credits against a 15-credit anonymous wallet, so a signed-out call could never succeed, and a tool that always fails is worse than a tool that is not there.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below — see Local validation: the HTTP path was exercised directly against production and returns a real image, but the plugin has not yet been installed into a Dify instance. Flagging this rather than ticking the box.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md, and manifest.yaml references it.
• All user-facing text is primarily in English.

Security and privacy notes

The plugin fetches one arbitrary URL supplied by the caller: edit_image takes an image_url and passes it to the Kavel API as the source photo. It is not fetched by the plugin process itself. No command execution, no code execution, no SQL, no SSH, no file operations, no proxying. No credential of the user is transmitted or stored — there is none. A fresh random anonymous identifier is generated per invocation and discarded, so two calls cannot be linked. Generated images are served from a public CDN URL, which PRIVACY.md states plainly.

Local validation

$ /tmp/dify-plugin plugin package .
INFO plugin packaged successfully output_path=kavel-0.0.1.difypkg

$ python3 -c "from tools._client import run; print(run('a single origami crane on dark slate, one hard rim light, macro'))"
https://cdn.kavel.ai/uploads/kie/image/35c1e0b9-3b94-4eaa-a1b4-15d02be9941c.webp

All four YAML files parse under yaml.safe_load. Dependencies: dify_plugin only — the HTTP path is standard library.

Reviewer notes

Known limitation, stated in the README rather than hidden: the anonymous grant is small on purpose (two generations or one edit before it asks for a sign-in) and the output is watermarked at 1K.