civitai-gen
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
generate.mjsscript utilizes thechild_processmodule to executeffmpegfor microphone recording and audio format conversion, andffplayfor optional audio playback. - [COMMAND_EXECUTION]: The
experiment.mjsscript invokesgenerate.mjsas a subprocess to manage bulk generation and parameter sweep workflows. - [EXTERNAL_DOWNLOADS]: The skill downloads generated media from Civitai's content delivery network. Additionally, the documentation suggests downloading a helper CLI script (
mcp-cli.mjs) from the vendor's official domain atmcp.civitai.com. - [PROMPT_INJECTION]: The
experiment.mjsscript implements a template expansion system that ingests data from local files. - Ingestion points: Wildcard values are read from
.txtand.jsonfiles within thewildcards/directory or from relative paths defined by the user. - Boundary markers: The system uses curly brace placeholders (e.g.,
{color}) to identify where substitutions should occur in the prompt template. - Capability inventory: The skill is capable of executing local system binaries (
ffmpeg,ffplay) and making authenticated network requests to the Civitai orchestration API. - Sanitization: The script includes a
sanitizeFilenamefunction to ensure names generated from templates are safe for the filesystem, although it does not filter the content of the expanded prompts themselves.
Audit Metadata