← 返回 Skills 市场

Civitai Generation API

Name: Civitai Generation API
Author: shinnpuru

作者 shinnpuru · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

909

总下载

当前安装

版本数

在 OpenClaw 中安装

/install civitai-api-art

功能描述

Generate AI images from prompts using CivitAI's JavaScript SDK with customizable models, samplers, seeds, steps, LoRA, and output options.

使用说明 (SKILL.md)

CivitAI AI Art Generation

Generate AI artwork using CivitAI's official JavaScript SDK.

Prerequisites

Node.js 18+ environment
CivitAI API access token (stored in environment variable CIVITAI_API_TOKEN)
civitai npm package installed

Installation

npm install civitai

Usage

node scripts/get_illust.js [options]

Options

Option	Description	Default
`--prompt`	Main generation prompt (required)	-
`--negative`	Negative prompt	"bad quality,worst quality,worst detail,sketch,censor"
`--width`	Image width	832
`--height`	Image height	1216
`--seed`	Random seed	random
`--steps`	Sampling steps	20
`--cfg-scale`	CFG scale	5
`--model`	Model URN identifier	"urn:air:sdxl:checkpoint:civitai:827184@2514310"
`--sampler`	Sampler algorithm	"Euler a"
`--clip-skip`	CLIP skip layers	2
`--output`	Output file path	"./output.png"
`--lora`	LoRA network URN with optional strength (format: `urn,strength`)	-

Example Usage

# 基础生成
node scripts/get_illust.js --prompt "1girl, red hair, blue eyes, maid outfit, smile" --output maid.png

# 高级设置
node scripts/get_illust.js \
  --prompt "1girl, long silver hair, purple eyes, magical girl, cityscape at night" \
  --negative "lowres, bad anatomy, bad hands, text, error, missing fingers, extra digit, fewer digits, cropped, worst quality, low quality, normal quality, jpeg artifacts, signature, watermark, username, blurry, bad feet" \
  --width 1024 \
  --height 1536 \
  --steps 28 \
  --cfg-scale 6 \
  --seed 42 \
  --output magical_girl.png

# 使用不同模型
node scripts/get_illust.js \
  --prompt "fantasy landscape, floating islands, waterfalls" \
  --model "urn:air:sdxl:checkpoint:civitai:101055@128641" \
  --output landscape.png

# 使用 LoRA
node scripts/get_illust.js \
  --prompt "1girl, red hair, blue eyes, maid outfit, smile" \
  --lora "urn:air:sdxl:lora:civitai:162141@182559,0.8" \
  --output maid_with_lora.png

# 使用多个 LoRA
node scripts/get_illust.js \
  --prompt "1girl, cat ears, cute smile, IncrsAhri, multiple tails" \
  --lora "urn:air:sd1:lora:civitai:162141@182559,1.0" \
  --lora "urn:air:sd1:lora:civitai:176425@198856,0.6" \
  --output multi_lora.png

Markdown 链接示例

生成图片后，使用 markdown 格式包裹链接：

[生成的图片](https://blobs-temp.s3.us-west-004.backblazeb2.com/...)

Scheduler Options

Available sampler values:

Sampler Name	Enum Value
Euler a	EULER_A
Euler	EULER
LMS	LMS
Heun	HEUN
DPM2	DPM2
DPM2 a	DPM2_A
DPM++ 2S a	DPM2_SA
DPM++ 2M	DPM2_M
DPM++ SDE	DPM_SDE
DPM fast	DPM_FAST
DPM adaptive	DPM_ADAPTIVE
LMS Karras	LMS_KARRAS
DPM2 Karras	DPM2_KARRAS
DPM2 a Karras	DPM2_A_KARRAS
DPM++ 2S a Karras	DPM2_SA_KARRAS
DPM++ 2M Karras	DPM2_M_KARRAS
DPM++ SDE Karras	DPM_SDE_KARRAS
DDIM	DDIM
PLMS	PLMS
UniPC	UNIPC
LCM	LCM
DDPM	DDPM
DEIS	DEIS

Notes

Requires Node.js 18+ for native fetch support
Store API tokens securely using environment variables
Generated images are subject to CivitAI's terms of service
Some models may require specific permissions or subscriptions
The script always waits for job completion by default

安全使用建议

This skill appears to implement what it claims (generating images via CivitAI), but the package metadata omitted key runtime requirements. Before installing: 1) Verify the skill's origin — the registry metadata lacks a homepage and lists no owner contact. 2) Expect to provide CIVITAI_API_TOKEN as an env var (the script will exit without it); confirm you are comfortable granting that token to a tool that will call the CivitAI API. 3) The SKILL.md asks you to 'npm install civitai' — confirm the npm package source and version, and prefer locking to a known-good version. 4) Note the script downloads the image from whatever blob URL the API returns; consider running the script in an isolated/containerized environment to reduce risk of malicious downloads. 5) Ask the publisher to update the registry metadata to declare CIVITAI_API_TOKEN and the civitai dependency explicitly (and ideally provide a homepage/source repo). If you need higher assurance, review the full 'civitai' npm package code and the included script in a sandbox before providing your API token.

功能分析

Type: OpenClaw Skill Name: civitai-api-art Version: 1.0.0 The skill is classified as suspicious due to a critical arbitrary file write vulnerability in `scripts/get_illust.js`. The script uses `path.resolve()` for the `--output` argument but does not sanitize the path to prevent writing to arbitrary locations on the filesystem (e.g., `/etc/passwd` or `~/.bashrc`) if a malicious absolute path is provided by the user or a compromised agent. While the stated purpose of generating and saving images is benign, this vulnerability allows for potential system compromise or data destruction.

能力评估

✓ Purpose & Capability

Name, description, SKILL.md, and the included script all align: the tool generates images via the CivitAI JavaScript SDK and accepts model/sampler/LoRA parameters. The requested functionality is coherent with the code.

ℹ Instruction Scope

Runtime instructions and the script stay within the stated purpose (submitting a generation job, waiting for completion, downloading the resulting blob URL, saving an image). The SKILL.md and script require a CIVITAI_API_TOKEN and the 'civitai' npm package. The markdown example includes an external blob/storage URL — the script will download whatever URL the API returns, which is expected but means the skill will make outbound requests to arbitrary blob URLs returned by the service.

ℹ Install Mechanism

There is no install spec (instruction-only), which is lower-risk, but the SKILL.md instructs users to 'npm install civitai' and the script requires the 'civitai' package. The registry metadata did not declare this dependency — an omission that can cause surprises and should be corrected. No direct downloads or extract steps are present in the skill bundle.

⚠ Credentials

The SKILL.md and the script require an environment variable CIVITAI_API_TOKEN (the script exits if it's missing). However, the registry metadata lists 'Required env vars: none' and 'Primary credential: none'. That mismatch is an important incoherence: a credential is required at runtime but not declared in the skill metadata.

✓ Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent platform privileges. It does write only the generated image to the specified output path and does not attempt to modify other skills or system-wide configs.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install civitai-api-art
安装完成后，直接呼叫该 Skill 的名称或使用 /civitai-api-art 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of civitai-ai-art: generate AI images using the CivitAI JavaScript SDK. - Supports Stable Diffusion model selection, custom prompts, negative prompts, seeds, output settings, and LoRA networks. - Command-line script with configurable parameters for prompt, width, height, model, sampler, steps, seed, output path, and more. - Multiple LoRA extensions supported for advanced image customization. - Requires Node.js 18+ and CivitAI API token. - Documentation includes usage examples and sampler options.

元数据

Slug civitai-api-art

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题