Civitai API

• Risk level: Low
• Analyzed: Apr 13, 2026, 4:37 PM
• Findings: 0
• Version: 1.0.0

Overview

This is a small, coherent CLI wrapper around the public Civitai REST API that reads a workspace .env for a CIVITAI_API_KEY and issues HTTP requests to civitai.com; nothing in the files suggests extraneous or malicious behavior.

This skill appears to do what it says, but before installing: (1) avoid committing your .env to source control — store CIVITAI_API_KEY in a secure place; (2) be aware that the script will read a .env in the skill folder or parent and will set any keys it finds as environment variables — keep only the needed CIVITAI_API_KEY there; (3) treat any printed download URL (which may include ?token=...) as sensitive and do not paste it into public chat; (4) if you prefer, pass the token via the --token flag or set CIVITAI_API_KEY in your environment rather than leaving it in workspace files; (5) optionally review the script (scripts/civitai.py) locally before use to confirm network calls go to civitai.com as expected.