MuleRouter

Generates images and videos using MuleRouter or MuleRun multimodal APIs. Text-to-Image, Image-to-Image, Text-to-Video, Image-to-Video, video editing (VACE, k...

Security Scan

The skill's code, requirements, and runtime instructions are consistent with a MuleRouter/MuleRun image/video generation client — nothing in the package indicates it is trying to do something unrelated to its stated purpose, though there are a few small inconsistencies you should be aware of before installing.

Purpose & Capability

Name/description (MuleRouter image/video generation) match the included Python client, model registry, model-specific CLI scripts, and the declared need for an API key and network access to MuleRouter/MuleRun endpoints. Required binaries (python3, uv) and the single primary credential (MULEROUTER_API_KEY) are appropriate for a client that calls an external API.

Instruction Scope

SKILL.md instructs the agent to run provided Python scripts via `uv run` and to read local image files (converting them to base64) before uploading to the API. The code includes explicit validation that blocks reading common sensitive dirs (.ssh, .aws, /etc, /proc, etc.) and forbids reading .env files, which reduces risk. Note: SKILL.md recommends creating a `.env` in the skill working directory to hold the API key (this is expected but you should avoid placing high-value secrets in project directories).

Install Mechanism

No external downloads or remote script execution URLs are present; dependencies are installed via `uv sync` as shown in SKILL.md and the metadata. However there's a minor coherence issue: the registry header stated 'No install spec — instruction-only', while SKILL.md and package metadata reference `uv sync` and include many code files. The package itself contains code (pyproject.toml), so running `uv sync` will install dependencies and write files to the environment — only run if you trust the source.

Credentials

The skill requires a single API credential (MULEROUTER_API_KEY) and one of MULEROUTER_BASE_URL or MULEROUTER_SITE to determine endpoint; this is proportional to the stated functionality. There are no unexpected secret env var requests or other unrelated credentials.

Persistence & Privilege

The skill is not set to always:true and does not request elevated or persistent system privileges. It does not modify other skills or system-wide configs. Autonomous invocation is enabled by default (disable-model-invocation is false) which is normal for skills — not an independent red flag here.

Assessment

This package appears to be a normal MuleRouter/MuleRun client: it uploads images/videos (local files may be read and converted to base64) and sends them to the configured API using the provided API key. Before installing or running: 1) Verify you trust the package source (the registry metadata/homepage point to a GitHub repo). 2) Inspect pyproject.toml to see installed dependencies and ensure `uv` is legitimate in your environment. 3) Avoid storing high-value secrets in a project `.env` in a shared/workspace; prefer an environment variable injected securely by your runtime if possible. 4) Do not upload images or videos that contain sensitive information. 5) If you need stronger assurances, run the code in an isolated environment (container/VM) and review network traffic to confirm requests only go to the expected api.mulerouter.ai or api.mulerun.com endpoints.

MuleRouter API

Generate images and videos using MuleRouter or MuleRun multimodal APIs.

Required Environment Variables

This skill requires the following environment variables to be set before use:

Variable	Required	Description
MULEROUTER_API_KEY	Yes	API key for authentication (get one here)
MULEROUTER_BASE_URL	Yes*	Custom API base URL (e.g., https://api.mulerouter.ai). Takes priority over SITE.
MULEROUTER_SITE	Yes*	API site: mulerouter or mulerun. Used if BASE_URL is not set.

*At least one of MULEROUTER_BASE_URL or MULEROUTER_SITE must be set.

The API key is included in Authorization: Bearer headers when making network calls to the configured API endpoint.

If any of these variables are missing, the scripts will fail with a configuration error. Check the Configuration section below to set them up.

Configuration Check

Before running any commands, verify the environment is configured:

Step 1: Check for existing configuration

Run the built-in config check script:

uv run python -c "from core.config import load_config; load_config(); print('Configuration OK')"

If this prints "Configuration OK", skip to Step 3. If it raises a ValueError, proceed to Step 2.

Step 2: Configure if needed

If the variables above are not set, ask the user to provide their API key and preferred endpoint.

Create a .env file in the skill's working directory:

# Option 1: Use custom base URL (takes priority over SITE)
MULEROUTER_BASE_URL=https://api.mulerouter.ai
MULEROUTER_API_KEY=your-api-key

# Option 2: Use site (if BASE_URL not set)
# MULEROUTER_SITE=mulerun
# MULEROUTER_API_KEY=your-api-key

Note: MULEROUTER_BASE_URL takes priority over MULEROUTER_SITE. If both are set, MULEROUTER_BASE_URL is used.

Note: The skill only loads variables prefixed with MULEROUTER_ from the .env file. Other variables in the file are ignored.

Important: Do NOT use export shell commands to set credentials. Use a .env file or ensure the variables are already present in your shell environment before invoking the skill.

Step 3: Using uv to run scripts

The skill uses uv for dependency management and execution. Make sure uv is installed and available in your PATH.

Run uv sync to install dependencies.

Quick Start

1. List available models

uv run python scripts/list_models.py

2. Check model parameters

uv run python models/alibaba/wan2.6-t2v/generation.py --list-params

3. Generate content

Text-to-Video:

uv run python models/alibaba/wan2.6-t2v/generation.py --prompt "A cat walking through a garden"

Text-to-Image:

uv run python models/alibaba/wan2.6-t2i/generation.py --prompt "A serene mountain lake"

Image-to-Video:

uv run python models/alibaba/wan2.6-i2v/generation.py --prompt "Gentle zoom in" --image "https://example.com/photo.jpg" #remote image url

uv run python models/alibaba/wan2.6-i2v/generation.py --prompt "Gentle zoom in" --image "/path/to/local/image.png" #local image path

Image Input

For image parameters (--image, --images, etc.), prefer local file paths over base64.

# Preferred: local file path (auto-converted to base64)
--image /tmp/photo.png

--images ["/tmp/photo.png"]

Local file paths are validated before reading: only files with recognized image extensions (.png, .jpg, .jpeg, .gif, .bmp, .webp, .tiff, .tif, .svg, .ico, .heic, .heif, .avif) are accepted. Paths pointing to sensitive system directories or non-image files are rejected. Valid image files are converted to base64 and sent to the API, avoiding command-line length limits that occur with raw base64 strings.

Workflow

1. Check configuration: verify MULEROUTER_API_KEY and either MULEROUTER_BASE_URL or MULEROUTER_SITE are set
2. Install dependencies: run uv sync
3. Run uv run python scripts/list_models.py to discover available models
4. Run uv run python models/<path>/<action>.py --list-params to see parameters
5. Execute with appropriate parameters
6. Parse output URLs from results

Model Selection

When listing models, each model's tags (e.g., [SOTA]) are displayed by default next to its name. Tags help identify model characteristics at a glance — for example, SOTA indicates a state-of-the-art model.

You can also filter models by tag using --tag:

uv run python scripts/list_models.py --tag SOTA

If you are unsure which model to use, present the available options to the user and let them choose. Use the AskUserQuestion tool (or equivalent interactive prompt) to ask the user which model they prefer. For example, if the user asks to "generate an image" without specifying a model, list the relevant image generation models with their tags and descriptions, and ask the user to pick one.

Tips

1. For an image generation model, a suggested timeout is 5 minutes.
2. For a video generation model, a suggested timeout is 15 minutes.

References

• REFERENCE.md - API configuration and CLI options
• MODELS.md - Complete model specifications