skills/artokun/comfyui-mcp/civitai/Gen Agent Trust Hub

civitai

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill interacts with official Civitai domains (civitai.com and mcp.civitai.com) to search for, download, and configure model assets. These references target a well-known service platform for generative AI models and are necessary for the skill's core functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content such as model names, creator descriptions, and trigger words retrieved from the Civitai API.
  • Ingestion points: External model metadata and trigger words retrieved through the search_civitai action and Civitai's REST API.
  • Boundary markers: The instructions do not specify explicit delimiters or boundary markers for the data retrieved from the external API.
  • Capability inventory: The skill utilizes download_model (file system writes), panel_add_node, and generate_image capabilities.
  • Sanitization: No explicit sanitization or filtering of strings retrieved from the external API is defined within the skill instructions.
  • [CREDENTIALS_UNSAFE]: The skill mentions the use of CIVITAI_API_TOKEN to access gated or early-access downloads. It correctly advises setting this token through secure channels like environment variables or application settings, avoiding hardcoded secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 10:18 PM
Security Audit — agent-trust-hub — civitai