muapi-media-editing
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill appears to do what it says—send user-selected media to muapi.ai for AI editing—but users should treat uploaded media and the MUAPI_KEY stored in `.env` as sensitive.
This skill is coherent for AI media editing and does not show artifact-backed malicious behavior. Before installing, be comfortable sending selected images, video, audio, face images, and masks to muapi.ai, keep the MUAPI_KEY private, and verify the referenced upload helper if using local file inputs.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Private photos, videos, audio, face images, or masks provided to the script may be sent to muapi.ai for processing.
When a user supplies a local file, the script uploads that selected file to the external muapi.ai API. This is purpose-aligned, but it is a sensitive data flow.
curl -s -X POST "${MUAPI_BASE}/upload_file" -H "x-api-key: $MUAPI_KEY" -F "file=@${FPATH}"Only run local-file options on media you are allowed to upload, and review muapi.ai’s privacy and retention terms before using sensitive media.
If the `.env` file is shared, committed, or readable by others, the muapi.ai API key could be exposed.
The script offers an `--add-key` path that saves the muapi.ai API key into a local `.env` file, and later uses MUAPI_KEY for API requests. This is expected for the service but should be handled as a credential.
echo "MUAPI_KEY=$KEY_VALUE" >> .env
Use a dedicated muapi.ai key, keep `.env` out of source control, restrict file permissions, and rotate the key if it may have been exposed.
Using `edit-image.sh --file` may depend on external local code that was not included in this review.
The image-editing script calls a helper script outside the provided file manifest for local file uploads, so that helper’s behavior is not reviewable from the supplied artifacts.
IMAGE_URL=$(bash "$(dirname "$0")/../media/upload.sh" --file "$IMAGE_FILE")
Verify that `../media/upload.sh` is present and trusted before using the `--file` path, or prefer explicit `--image-url` inputs.
A malicious or unexpected `.env` in the working directory could run shell commands when the script starts.
The script loads configuration by shell-sourcing `.env`; this is likely intended to read MUAPI_KEY, but shell sourcing can execute commands if the `.env` file contains them.
if [ -f ".env" ]; then source .env 2>/dev/null || true; fi
Keep `.env` files trusted and local to the skill, and prefer safer key-loading logic that parses MUAPI_KEY without shell-sourcing arbitrary file contents.