Mulerouter

Generates images and videos using MuleRouter or MuleRun multimodal APIs. Text-to-Image, Image-to-Image, Text-to-Video, Image-to-Video, video editing (VACE, keyframe interpolation). Use when the user wants to generate, edit, or transform images and videos using AI models like Wan2.6, Veo3, Nano Banana Pro, Sora2, Midjourney.

Security Scan

The code and runtime instructions match an image/video-generation router, but the package metadata, configuration declarations, and runtime behavior are inconsistent in ways that could lead to accidental secret exposure or surprising behavior; review before installing or running.

Purpose & Capability

The SKILL.md and code clearly expect an API key and environment variables (MULEROUTER_API_KEY, MULEROUTER_BASE_URL or MULEROUTER_SITE) and require Python + uv and network access to api.mulerouter.ai / api.mulerun.com, but the registry metadata lists no required env vars or binaries. That mismatch is incoherent: the skill will fail or prompt for secrets at runtime unless an API key is provided, yet metadata doesn't declare the requirement.

Instruction Scope

Runtime instructions ask the user/agent to check and print environment variables, load a .env from the current directory, run dependency installation (uv sync) and execute Python scripts that will read local image/video files and convert them to base64 to send to remote APIs. Reading and uploading local files is expected for this skill, but the instructions explicitly recommend running from the skill root and will load any .env found in the current working directory — this can unintentionally load unrelated secrets. The configuration-check commands also print the base URL and may expose variable values if run carelessly.

Install Mechanism

There is no install spec (instruction-only install), which is low risk for installation, but the package contains many Python source files that will be executed locally. The SKILL.md requires the 'uv' runner and Python 3.10+, so the real runtime dependency is heavier than metadata indicates. No network downloads from untrusted URLs are present in an install step, but running the scripts will contact remote APIs.

Credentials

The code requires an API key (MULEROUTER_API_KEY) and optionally a base URL or site selector; those are appropriate for a remote API integration. However, registry metadata declared no required env vars. The skill also loads a .env file from the current directory (dotenv) which can pull in unrelated secrets if the working directory contains such a file. The number and sensitivity of environment variables requested is moderate and appropriate for the purpose, but the failure to declare them in metadata and the .env loading behavior are concerning.

Persistence & Privilege

The skill does not request permanent inclusion (always:false) and does not modify other skills or system-wide settings. It identifies itself in outgoing requests via User-Agent headers but does not request elevated system persistence. Autonomous model invocation is allowed by default (disable-model-invocation:false), which is normal for skills; combined with the network access requirement this increases the operational blast radius but is expected for this integration.

What to consider before installing

This skill's code appears to implement a legitimate MuleRouter/MuleRun client for generating images/videos, but there are a few red flags you should consider before installing or running it: - Metadata mismatch: The skill metadata claims no required env vars, but the code and SKILL.md require MULEROUTER_API_KEY and either MULEROUTER_BASE_URL or MULEROUTER_SITE. Expect to provide an API key. - .env loading risk: The code will load a .env from the current working directory. Don't run these scripts from a directory that contains other secrets or .env files you don't want uploaded or printed. Prefer running in an isolated/sandboxed directory. - Local file upload: The tool prefers local file paths and will convert local images/videos to base64 and send them to the remote API. Only use files you are comfortable sending to the remote service. - No homepage / unknown source: There is no source/homepage or maintainer metadata. If possible, obtain a trusted upstream URL or verify the repository origin and maintainers before using API keys with this skill. - Run in a sandbox first: If you must try it, run it in a controlled environment (isolated container or VM) with a throwaway API key and minimal local files to confirm behavior. If you want to proceed safely, ask the publisher for a homepage or source repo, ensure the API endpoint is the official MuleRouter/MuleRun endpoint you expect, and avoid running the skill from directories that contain unrelated .env files or secrets.

MuleRouter API

Generate images and videos using MuleRouter or MuleRun multimodal APIs.

Configuration Check

Before running any commands, verify the environment is configured:

Step 1: Check for existing configuration

# Check environment variables
echo "MULEROUTER_BASE_URL: $MULEROUTER_BASE_URL"
echo "MULEROUTER_SITE: $MULEROUTER_SITE"
echo "MULEROUTER_API_KEY: ${MULEROUTER_API_KEY:+[SET]}"

# Check for .env file
ls -la .env 2>/dev/null || echo "No .env file found"

Step 2: Configure if needed

Option A: Environment variables with custom base URL (highest priority)

export MULEROUTER_BASE_URL="https://api.mulerouter.ai"  # or your custom API endpoint
export MULEROUTER_API_KEY="your-api-key"

Option B: Environment variables with site (used if base URL not set)

export MULEROUTER_SITE="mulerun"    # or "mulerouter"
export MULEROUTER_API_KEY="your-api-key"

Option C: Create .env file

Create .env in the current working directory:

# Option 1: Use custom base URL (takes priority over SITE)
MULEROUTER_BASE_URL=https://api.mulerouter.ai
MULEROUTER_API_KEY=your-api-key

# Option 2: Use site (if BASE_URL not set)
# MULEROUTER_SITE=mulerun
# MULEROUTER_API_KEY=your-api-key

Note: MULEROUTER_BASE_URL takes priority over MULEROUTER_SITE. If both are set, MULEROUTER_BASE_URL is used.

Note: The tool only reads .env from the current directory. Run scripts from the skill root (skills/mulerouter-skills/).

Step 3: Using uv to run scripts

The skill uses uv for dependency management and execution. Make sure uv is installed and available in your PATH.

Run uv sync to install dependencies.

Quick Start

1. List available models

uv run python scripts/list_models.py

2. Check model parameters

uv run python models/alibaba/wan2.6-t2v/generation.py --list-params

3. Generate content

Text-to-Video:

uv run python models/alibaba/wan2.6-t2v/generation.py --prompt "A cat walking through a garden"

Text-to-Image:

uv run python models/alibaba/wan2.6-t2i/generation.py --prompt "A serene mountain lake"

Image-to-Video:

uv run python models/alibaba/wan2.6-i2v/generation.py --prompt "Gentle zoom in" --image "https://example.com/photo.jpg" #remote image url

uv run python models/alibaba/wan2.6-i2v/generation.py --prompt "Gentle zoom in" --image "/path/to/local/image.png" #local image path

Image Input

For image parameters (--image, --images, etc.), prefer local file paths over base64.

# Preferred: local file path (auto-converted to base64)
--image /tmp/photo.png

--images ["/tmp/photo.png"]

The skill automatically converts local file paths to base64 before sending to the API. This avoids command-line length limits that occur with raw base64 strings.

Workflow

1. Check configuration: verify MULEROUTER_BASE_URL or MULEROUTER_SITE, and MULEROUTER_API_KEY are set
2. Install dependencies: run uv sync
3. Run uv run python scripts/list_models.py to discover available models
4. Run uv run python models/<path>/<action>.py --list-params to see parameters
5. Execute with appropriate parameters
6. Parse output URLs from results

Tips

1. For an image generation model, a suggested timeout is 5 minutes.
2. For a video generation model, a suggested timeout is 15 minutes.

References

• REFERENCE.md - API configuration and CLI options
• MODELS.md - Complete model specifications