← Back to Skills Marketplace
ninjazan420

Immich API Connector

by Administrator · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
786
Downloads
4
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install immich-api
Description
Connect to self-hosted Immich instances to manage photos, albums, users, search media, upload/download files, and handle jobs via REST API.
README (SKILL.md)

Immich API Bridge

Configuration

Option 1: Environment Variables

Windows (PowerShell):

$env:IMMICH_URL = "https://your-immich-instance.com"
$env:IMMICH_API_KEY = "your-api-key-here"

Linux/macOS (bash):

export IMMICH_URL="https://your-immich-instance.com"
export IMMICH_API_KEY="your-api-key-here"

Generate API Key in Immich: User Profile → API Keys → Create API Key

Option 2: CLI Arguments

python scripts/upload_photos.py --url "https://your-immich.com" --api-key "your-key" --folder ./photos
python scripts/download_album.py --url "https://your-immich.com" --api-key "your-key" --album-id "abc123" --output ./downloads

Quick Start

Authentication

# Test connection
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/server-info/ping"

Base URL

{IMMICH_URL}/api

Common Operations

Albums

# List albums
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/albums"

# Create album
curl -X POST -H "x-api-key: $IMMICH_API_KEY" -H "Content-Type: application/json" \
  -d '{"albumName":"My Album"}' "$IMMICH_URL/api/albums"

# Get album assets
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/albums/{albumId}"

Assets

# Get all assets (paginated)
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/assets?limit=100"

# Upload asset
curl -X POST -H "x-api-key: $IMMICH_API_KEY" \
  -F "file=@/path/to/photo.jpg" \
  "$IMMICH_URL/api/assets"

# Get thumbnail
curl -H "x-api-key: $IMMICH_API_KEY" \
  "$IMMICH_URL/api/assets/{assetId}/thumbnail?format=jpeg" -o thumb.jpg

# Get original file
curl -H "x-api-key: $IMMICH_API_KEY" \
  "$IMMICH_URL/api/assets/{assetId}/original" -o original.jpg

Users

# List users
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/users"

# Get current user
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/user/me"

Search

# Search assets
curl -X POST -H "x-api-key: $IMMICH_API_KEY" -H "Content-Type: application/json" \
  -d '{"query":"beach","take":10}' "$IMMICH_URL/api/search/assets"

Libraries

# List libraries
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/libraries"

# Scan library
curl -X POST -H "x-api-key: $IMMICH_API_KEY" \
  "$IMMICH_URL/api/libraries/{libraryId}/scan"

Jobs

# Get job statuses
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/jobs"

# Trigger job (e.g., thumbnail generation)
curl -X POST -H "x-api-key: $IMMICH_API_KEY" -H "Content-Type: application/json" \
  -d '{"jobName":"thumbnail-generation","force":true}' "$IMMICH_URL/api/jobs"

Script Usage

Use the bundled scripts in scripts/ for complex operations:

  • upload_photos.py - Bulk upload photos
  • download_album.py - Download entire album
  • sync_library.py - Sync external library

See references/api-endpoints.md for complete endpoint reference.

Usage Guidance
This skill appears to be a straightforward Immich API client, but take these precautions before installing or running it: - The scripts and SKILL.md require an Immich base URL and an API key (IMMICH_URL / IMMICH_API_KEY), but the registry metadata did not declare those — expect to provide them yourself. - Review the included Python scripts yourself (they are small and readable). They only make HTTP requests to the provided IMMICH_URL and read files from the folder you give them; they do not call other domains or contain obfuscated code. - Do not pass long-lived sensitive credentials on command lines in shared environments; prefer environment variables and limit API key scope where possible. - Be careful with the upload script: it will read files from the specified folder and POST them to the Immich instance you point it at — ensure you trust that instance before uploading private media. - If you need stronger assurance, run the scripts in an isolated environment (container or VM) and monitor network connections to confirm traffic goes only to your Immich host. If the author/source were known or the registry metadata were updated to declare the required env vars/primary credential, my confidence would rise. Conversely, if you find the SKILL.md or scripts making requests to unexpected domains or asking for unrelated credentials, treat the skill as suspicious and do not provide secrets.
Capability Analysis
Type: OpenClaw Skill Name: immich-api Version: 1.0.0 The skill bundle is classified as suspicious due to a potential path traversal vulnerability in `scripts/download_album.py`. The script constructs file paths for downloaded assets using `album_name` and `originalFileName` values retrieved directly from the Immich API response. If a malicious or compromised Immich server provides filenames containing path traversal sequences (e.g., `../../etc/passwd`), the script could write files outside the intended output directory, leading to arbitrary file write on the agent's system. There is no evidence of intentional malicious behavior, data exfiltration, or prompt injection attempts in SKILL.md.
Capability Assessment
Purpose & Capability
Name/description match the actual behavior: the SKILL.md and bundled Python scripts implement Immich REST operations (albums, assets, jobs, upload/download). Nothing in the code or instructions requests unrelated services or capabilities. However, the skill metadata declares no required environment variables or primary credential while the SKILL.md and scripts clearly expect an IMMICH_URL and an API key (IMMICH_API_KEY). This is a documentation/metadata omission rather than functional mismatch.
Instruction Scope
Runtime instructions are narrowly scoped to Immich API interactions (curl examples) and to using the included scripts. The scripts perform expected actions: make HTTP requests to the provided IMMICH_URL and read/upload files from a user-specified folder. They do not reference other system files, hidden endpoints, or unrelated environment variables. The only minor issue: SKILL.md suggests using environment variables but the manifest didn't declare them.
Install Mechanism
No install spec; this is instruction-only with two small Python scripts included. There are no downloads from external URLs, no archive extraction, and no package installation steps — low install-surface risk.
Credentials
The skill requires an Immich API key and base URL to operate (SKILL.md and scripts use IMMICH_API_KEY / IMMICH_URL or CLI args). The registry metadata however declares no required env vars or primary credential. Requiring an API key is proportionate to the stated purpose, but the missing declaration is an oversight that can mislead users about what secrets are needed.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and is user-invocable. It does not request persistent platform privileges beyond normal operation. The scripts operate on local files only when given explicit paths.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install immich-api
  3. After installation, invoke the skill by name or use /immich-api
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of Immich Photo Management API Bridge. - Enables interaction with self-hosted Immich instances via REST API. - Provides quick-start guides for authentication and common operations (albums, assets, users, search, libraries, jobs). - Includes usage examples for managing photos, albums, and user accounts. - Bundled scripts for bulk uploading, downloading albums, and synchronizing libraries. - Reference to full API endpoint documentation included.
Metadata
Slug immich-api
Version 1.0.0
License
All-time Installs 2
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Immich API Connector?

Connect to self-hosted Immich instances to manage photos, albums, users, search media, upload/download files, and handle jobs via REST API. It is an AI Agent Skill for Claude Code / OpenClaw, with 786 downloads so far.

How do I install Immich API Connector?

Run "/install immich-api" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Immich API Connector free?

Yes, Immich API Connector is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Immich API Connector support?

Immich API Connector is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Immich API Connector?

It is built and maintained by Administrator (@ninjazan420); the current version is v1.0.0.

💬 Comments