← 返回 Skills 市场

liblib-comfyui-fusion

Name: liblib-comfyui-fusion
Author: 1213qwerwef

作者 zhangmin · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

100

总下载

当前安装

版本数

在 OpenClaw 中安装

/install liblib-comfyui-fusion

功能描述

Generate product background fusion images via LiblibAI ComfyUI app API using signed AccessKey/SecretKey requests. Use when user asks for Liblib Comfy app gen...

使用说明 (SKILL.md)

Liblib Comfy Fusion Generation

Generate images with LiblibAI ComfyUI App API (template-based workflow). Supports public image URL or local file.

For local files from Feishu, the recommended flow is:

upload the local file to R2 (S3-compatible) to get a public URL
use that public URL as the Liblib LoadImage input
return the Liblib result imageUrl as MEDIA:https://... so Feishu displays it directly

Prerequisites

Environment variables must be set:

LIB_ACCESS_KEY — API access key
LIB_SECRET_KEY — API secret key

Usage

Run the CLI at scripts/liblib_client.py:

# Public URL input
python3 scripts/liblib_client.py run --image-url "https://example.com/input.jpg"

# Local file (Feishu inbound attachment) → upload to R2 → use public URL
python3 scripts/liblib_client.py run --local-image "/path/to/input.png" --basename "product-fusion"

# Local file (advanced): embed as data URI (only if Liblib accepts it)
python3 scripts/liblib_client.py run --local-image "/path/to/input.png" --local-image-mode data-uri

# Parse URL from Feishu message text
python3 scripts/liblib_client.py run --feishu-text "请处理这个图 https://example.com/input.jpg"

# Submit only (no poll)
python3 scripts/liblib_client.py run --local-image "./input.jpg" --no-poll

# Query task status
python3 scripts/liblib_client.py status \x3CgenerateUuid>

Output and Feishu 回传

After a successful run (generateStatus=5), the script downloads images[].imageUrl into workspace/outputs/images/YYYY-MM-DD/\x3Cbasename>.(png|jpg|...) (override with --output-dir).
stdout prints a single line: MEDIA:./outputs/images/YYYY-MM-DD/\x3Cfile> (relative to workspace/). Use this with OpenClaw Feishu channel so the image appears in the current chat without extra API calls.
Full task JSON is printed to stderr for debugging.
If MEDIA: is not supported in your channel, use feishu-uploader with --receive-id-type chat_id and the group chat_id, or --open-id for DM.

Parameters (run)

Flag	Meaning
`--local-image`	Local path; takes priority over URL. Default mode uploads to R2 and uses public URL.
`--local-image-mode`	`r2` (default) or `data-uri`.
`--image-url`	Public URL the Liblib servers can fetch.
`--feishu-text` / `FEISHU_TEXT`	Extract first `http(s)` URL from text.
`--output-dir`	Default: `\x3Cworkspace>/outputs/images`.
`--basename`	Filename stem (default `liblib-fusion`).
`--no-download`	Skip downloading result files.
`--no-print-media`	Do not print `MEDIA:` line; stdout prints absolute path of first saved file instead.

API Details

Submit endpoint: POST /api/generate/comfyui/app
Status endpoint: POST /api/generate/comfy/status
Auth query params: AccessKey, Signature, Timestamp, SignatureNonce
Signature algorithm:
- content = uriPath & Timestamp & SignatureNonce
- HMAC-SHA1(secretKey, content)
- URL-safe Base64 without trailing =

Async Pattern

Submit task to get generateUuid
Poll status endpoint until generateStatus is 5 (success) or 6 (failed)
Read images[].imageUrl when successful

Notes

URL input: must be publicly reachable by Liblib.
Local input: default uses R2 upload to produce a public URL. Requires boto3.
Returned image URLs are temporary (typically ~7 days).
If API returns content review errors, try a different source image or URL.

安全使用建议

This skill appears to implement Liblib ComfyUI generation, but there are several red flags and missing details you should address before installing or running it: - Declare and provide credentials only if you trust the endpoint: the script requires LIB_ACCESS_KEY and LIB_SECRET_KEY for Liblib API signing. Only supply these to trusted code/hosts. - The client can optionally upload local images to an S3-compatible R2 bucket. That requires R2_ACCESS_KEY / R2_SECRET_KEY (write access). Only provide R2 credentials if you understand and control the target bucket; otherwise use --local-image-mode data-uri to avoid uploading. - Runtime requirements are undeclared: the package expects python3 and the Python dependencies requests and boto3 (boto3 only needed for R2 uploads). Ensure these are installed from trusted sources; the package.json does not declare them. - The Node entrypoint appears broken: index.js spawns 'client.py' but the actual script is scripts/liblib_client.py. Expect a runtime error unless the wrapper or packaging is fixed. Ask the author to fix the entrypoint so the skill runs as documented. - The script prints the full API task JSON to stderr. That JSON may contain metadata you consider sensitive — check it before sharing or storing. - Network behavior: the tool contacts https://openapi.liblibai.cloud and downloads images from URLs produced by that API. If you do not trust those endpoints or the images they return, consider running this in an isolated environment. If you decide to proceed: get a corrected package (fix entrypoint), verify source/trust of the code, only provide the minimal credentials needed (or use data-uri mode), and run it in an environment where workspace/outputs is isolated. If you cannot validate the code origin, treat it as untrusted and do not supply secrets.

功能分析

Type: OpenClaw Skill Name: liblib-comfyui-fusion Version: 1.0.0 The skill bundle is a legitimate integration for the LiblibAI ComfyUI API, allowing users to generate images via a template-based workflow. The core logic in `scripts/liblib_client.py` handles API authentication via HMAC-SHA1 signatures and provides a mechanism to upload local images to Cloudflare R2 (S3-compatible storage) to generate public URLs required by the LiblibAI service. All sensitive credentials (API keys, R2 secrets) are handled via environment variables or command-line arguments, and no evidence of data exfiltration, unauthorized execution, or malicious prompt injection was found.

能力评估

ℹ Purpose & Capability

Name/description, SKILL.md, and the Python client implement Liblib ComfyUI submission, polling, and optional Cloudflare R2 upload — this aligns with the stated purpose. However, the registry metadata claims no required env vars or binaries while the SKILL.md and script require LIB_ACCESS_KEY and LIB_SECRET_KEY (and optionally R2 creds and python/boto3). That mismatch is unexpected.

⚠ Instruction Scope

SKILL.md instructs use of LIB_ACCESS_KEY / LIB_SECRET_KEY and to run scripts/liblib_client.py. The Python script accesses additional environment variables (R2_* defaults, FEISHU_TEXT) and performs network I/O (calls openapi.liblibai.cloud, downloads returned image URLs) and optional upload to R2. These actions are consistent with the feature, but SKILL.md and package metadata do not fully document all env vars and binary/runtime requirements (python3, boto3). The script also prints full task JSON to stderr (could include sensitive metadata).

⚠ Install Mechanism

There is no install spec (instruction-only style), but the package includes a Python client that depends on python3 and boto3. The plugin's Node entrypoint attempts to spawn a Python process named 'client.py' (index.js: spawn('python3', ['client.py', ...])). The actual Python file is scripts/liblib_client.py, so the entrypoint is likely broken — runtime failure or confusion. The lack of declared runtime dependencies (python3, boto3, requests) is an inconsistency.

⚠ Credentials

SKILL.md explicitly requires LIB_ACCESS_KEY and LIB_SECRET_KEY — appropriate for signing requests to Liblib. The Python client also accepts/reads multiple R2-related environment variables (R2_ENDPOINT, R2_ACCESS_KEY, R2_SECRET_KEY, R2_BUCKET, PUBLIC_URL_BASE) and FEISHU_TEXT; these are not declared in the registry metadata. Because R2 credentials grant write access to an S3-compatible bucket, request for them is only justified if you plan to upload local images; the skill does not declare which envs are mandatory vs optional, nor declare a primary credential.

✓ Persistence & Privilege

The skill does not request always:true and does not attempt to modify other skills or system-wide settings. It writes outputs into a workspace/outputs directory (normal for a generator) and prints MEDIA: lines for Feishu integration. No excessive persistence or privilege escalation is requested.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install liblib-comfyui-fusion
安装完成后，直接呼叫该 Skill 的名称或使用 /liblib-comfyui-fusion 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of liblib-comfy-fusion. - Enables product background fusion image generation via LiblibAI ComfyUI API using authenticated requests. - Supports public image URLs, Feishu attachments (via R2 upload), and local file input. - Includes command-line client for submitting, polling, and downloading image generation tasks. - Provides integration guidance for Feishu, including MEDIA output and message URL extraction. - Documents all API endpoints, authentication requirements, expected outputs, and async operation pattern.

元数据

Slug liblib-comfyui-fusion

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题