← 返回 Skills 市场
Immich API Connector
作者
Administrator
· GitHub ↗
· v1.0.0
786
总下载
4
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install immich-api
功能描述
Connect to self-hosted Immich instances to manage photos, albums, users, search media, upload/download files, and handle jobs via REST API.
使用说明 (SKILL.md)
Immich API Bridge
Configuration
Option 1: Environment Variables
Windows (PowerShell):
$env:IMMICH_URL = "https://your-immich-instance.com"
$env:IMMICH_API_KEY = "your-api-key-here"
Linux/macOS (bash):
export IMMICH_URL="https://your-immich-instance.com"
export IMMICH_API_KEY="your-api-key-here"
Generate API Key in Immich: User Profile → API Keys → Create API Key
Option 2: CLI Arguments
python scripts/upload_photos.py --url "https://your-immich.com" --api-key "your-key" --folder ./photos
python scripts/download_album.py --url "https://your-immich.com" --api-key "your-key" --album-id "abc123" --output ./downloads
Quick Start
Authentication
# Test connection
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/server-info/ping"
Base URL
{IMMICH_URL}/api
Common Operations
Albums
# List albums
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/albums"
# Create album
curl -X POST -H "x-api-key: $IMMICH_API_KEY" -H "Content-Type: application/json" \
-d '{"albumName":"My Album"}' "$IMMICH_URL/api/albums"
# Get album assets
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/albums/{albumId}"
Assets
# Get all assets (paginated)
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/assets?limit=100"
# Upload asset
curl -X POST -H "x-api-key: $IMMICH_API_KEY" \
-F "file=@/path/to/photo.jpg" \
"$IMMICH_URL/api/assets"
# Get thumbnail
curl -H "x-api-key: $IMMICH_API_KEY" \
"$IMMICH_URL/api/assets/{assetId}/thumbnail?format=jpeg" -o thumb.jpg
# Get original file
curl -H "x-api-key: $IMMICH_API_KEY" \
"$IMMICH_URL/api/assets/{assetId}/original" -o original.jpg
Users
# List users
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/users"
# Get current user
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/user/me"
Search
# Search assets
curl -X POST -H "x-api-key: $IMMICH_API_KEY" -H "Content-Type: application/json" \
-d '{"query":"beach","take":10}' "$IMMICH_URL/api/search/assets"
Libraries
# List libraries
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/libraries"
# Scan library
curl -X POST -H "x-api-key: $IMMICH_API_KEY" \
"$IMMICH_URL/api/libraries/{libraryId}/scan"
Jobs
# Get job statuses
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/jobs"
# Trigger job (e.g., thumbnail generation)
curl -X POST -H "x-api-key: $IMMICH_API_KEY" -H "Content-Type: application/json" \
-d '{"jobName":"thumbnail-generation","force":true}' "$IMMICH_URL/api/jobs"
Script Usage
Use the bundled scripts in scripts/ for complex operations:
upload_photos.py- Bulk upload photosdownload_album.py- Download entire albumsync_library.py- Sync external library
See references/api-endpoints.md for complete endpoint reference.
安全使用建议
This skill appears to be a straightforward Immich API client, but take these precautions before installing or running it:
- The scripts and SKILL.md require an Immich base URL and an API key (IMMICH_URL / IMMICH_API_KEY), but the registry metadata did not declare those — expect to provide them yourself.
- Review the included Python scripts yourself (they are small and readable). They only make HTTP requests to the provided IMMICH_URL and read files from the folder you give them; they do not call other domains or contain obfuscated code.
- Do not pass long-lived sensitive credentials on command lines in shared environments; prefer environment variables and limit API key scope where possible.
- Be careful with the upload script: it will read files from the specified folder and POST them to the Immich instance you point it at — ensure you trust that instance before uploading private media.
- If you need stronger assurance, run the scripts in an isolated environment (container or VM) and monitor network connections to confirm traffic goes only to your Immich host.
If the author/source were known or the registry metadata were updated to declare the required env vars/primary credential, my confidence would rise. Conversely, if you find the SKILL.md or scripts making requests to unexpected domains or asking for unrelated credentials, treat the skill as suspicious and do not provide secrets.
功能分析
Type: OpenClaw Skill
Name: immich-api
Version: 1.0.0
The skill bundle is classified as suspicious due to a potential path traversal vulnerability in `scripts/download_album.py`. The script constructs file paths for downloaded assets using `album_name` and `originalFileName` values retrieved directly from the Immich API response. If a malicious or compromised Immich server provides filenames containing path traversal sequences (e.g., `../../etc/passwd`), the script could write files outside the intended output directory, leading to arbitrary file write on the agent's system. There is no evidence of intentional malicious behavior, data exfiltration, or prompt injection attempts in SKILL.md.
能力评估
Purpose & Capability
Name/description match the actual behavior: the SKILL.md and bundled Python scripts implement Immich REST operations (albums, assets, jobs, upload/download). Nothing in the code or instructions requests unrelated services or capabilities. However, the skill metadata declares no required environment variables or primary credential while the SKILL.md and scripts clearly expect an IMMICH_URL and an API key (IMMICH_API_KEY). This is a documentation/metadata omission rather than functional mismatch.
Instruction Scope
Runtime instructions are narrowly scoped to Immich API interactions (curl examples) and to using the included scripts. The scripts perform expected actions: make HTTP requests to the provided IMMICH_URL and read/upload files from a user-specified folder. They do not reference other system files, hidden endpoints, or unrelated environment variables. The only minor issue: SKILL.md suggests using environment variables but the manifest didn't declare them.
Install Mechanism
No install spec; this is instruction-only with two small Python scripts included. There are no downloads from external URLs, no archive extraction, and no package installation steps — low install-surface risk.
Credentials
The skill requires an Immich API key and base URL to operate (SKILL.md and scripts use IMMICH_API_KEY / IMMICH_URL or CLI args). The registry metadata however declares no required env vars or primary credential. Requiring an API key is proportionate to the stated purpose, but the missing declaration is an oversight that can mislead users about what secrets are needed.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and is user-invocable. It does not request persistent platform privileges beyond normal operation. The scripts operate on local files only when given explicit paths.
如何使用
- 确保已安装 OpenClaw(本地或 Docker 部署)
- 在对话框中输入安装命令:
/install immich-api - 安装完成后,直接呼叫该 Skill 的名称或使用
/immich-api触发 - 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial release of Immich Photo Management API Bridge.
- Enables interaction with self-hosted Immich instances via REST API.
- Provides quick-start guides for authentication and common operations (albums, assets, users, search, libraries, jobs).
- Includes usage examples for managing photos, albums, and user accounts.
- Bundled scripts for bulk uploading, downloading albums, and synchronizing libraries.
- Reference to full API endpoint documentation included.
元数据
常见问题
Immich API Connector 是什么?
Connect to self-hosted Immich instances to manage photos, albums, users, search media, upload/download files, and handle jobs via REST API. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 786 次。
如何安装 Immich API Connector?
在 OpenClaw 或 Claude Code 对话框中运行命令「/install immich-api」即可一键安装,无需额外配置。
Immich API Connector 是免费的吗?
是的,Immich API Connector 完全免费(开源免费),可自由下载、安装和使用。
Immich API Connector 支持哪些平台?
Immich API Connector 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。
谁开发了 Immich API Connector?
由 Administrator(@ninjazan420)开发并维护,当前版本 v1.0.0。
推荐 Skills