luci-upload

Upload a video or image to memories.ai. Use when the user wants to upload media, add a video/photo to their memory, or send a file to Luci. This skill is des...

Security Scan

The skill's code, required environment variable, and runtime instructions are coherent with its stated purpose (uploading media to memories.ai), though it will upload user media (including extracted GPS/time metadata) to an external service and perform external geocoding which has privacy implications.

Purpose & Capability

Name/description, required binaries (python3, ffprobe), and required env var (MEMORIES_AI_KEY) match the behavior in the included scripts: the code probes files, extracts metadata, and uploads to a memories.ai backend. The presence of a single API key is appropriate for this purpose.

Instruction Scope

SKILL.md instructs the agent to probe local media files and upload them; that matches the script. The instructions and code read a local .env for MEMORIES_AI_KEY and read the user-specified file. They also make outbound HTTP requests (upload to mavi-backend.memories.ai and geocoding to nominatim.openstreetmap.org). This is expected for the skill, but it means the agent will transmit file contents and any extracted GPS/time metadata off-device.

Install Mechanism

No install spec is provided (instruction-only install), and the repository includes runnable scripts (run.sh and scripts/run.py). No third-party downloads or archive extraction occur. Execution is local via python3 and ffprobe as declared.

Credentials

Only MEMORIES_AI_KEY is required and declared as the primary credential. The script also looks for a .env file co-located with the skill root as a convenience; this is consistent with its key usage. No unrelated secrets or multiple unrelated credentials are requested.

Persistence & Privilege

The skill does not request always: true and does not modify other skills or system-wide settings. It reads a local .env file and user-specified media files only, which is normal for its function.

Assessment

This skill will upload user-provided media (video/photo) and any extracted time and GPS metadata to an external memories.ai backend and will call OpenStreetMap's Nominatim for geocoding. Before installing, confirm you trust the memories.ai service and the skill owner; avoid uploading sensitive content or media containing private location data unless you are comfortable with that service storing it. Ensure MEMORIES_AI_KEY you provide is scoped appropriately (not a super-privileged or unrelated secret), keep backups of any sensitive files, and consider running the script with --probe first to see what metadata would be extracted before performing an upload. If you need higher assurance, review or run the included scripts in a sandboxed environment to observe network endpoints and behavior (the scripts show the upload host: https://mavi-backend.memories.ai and a geocoding call to nominatim.openstreetmap.org).

Upload a video or image file to memories.ai with capture time and location metadata. User can also download LUCI AI app to manually upload as well.

Setup

Requires MEMORIES_AI_KEY — same key as luci-memory. If not found, create {baseDir}/.env:

MEMORIES_AI_KEY=sk-your-key-here

Also requires ffprobe (from ffmpeg) for auto-extracting video metadata. Images can be uploaded without ffprobe finding anything — in that case the agent must supply time and location explicitly.

When to use

• User wants to upload a video or image to memories.ai
• User says "add this video/photo to my memory" or similar
• User wants to send/import media to Luci

How it works

The script tries to auto-extract capture time and GPS coordinates from the file metadata (via ffprobe). Videos from phones and JPEGs with EXIF usually work; PNGs and screenshots rarely have this info. If metadata is missing, the agent should ask the user for:

1. When was it taken? → pass as --datetime with --timezone
2. Where was it taken? → pass as --location (geocoded automatically) or --lat/--lon

The multipart Content-Type is chosen by file extension (.mp4 → video/mp4, .png → image/png, .jpg → image/jpeg, etc.).

How to invoke

# Probe metadata only (no upload) — do this first to check what info is available
bash {baseDir}/run.sh --probe --file /path/to/file

# Upload a video with auto-detected metadata
bash {baseDir}/run.sh --file /path/to/video.mp4

# Upload a video with explicit time and location name (geocoded to lat/lon)
bash {baseDir}/run.sh --file /path/to/video.mp4 --datetime "2025-06-22 14:00:00" --timezone Asia/Shanghai --location "Suzhou, China"

# Upload an image — usually needs explicit time/location since EXIF is often missing
bash {baseDir}/run.sh --file /path/to/photo.png --datetime "2025-09-01 00:00:00" --timezone Asia/Shanghai --location "Shunde, China"

# Upload with explicit coordinates and epoch timestamp
bash {baseDir}/run.sh --file /path/to/video.mp4 --time 1769097600000 --lat 31.3 --lon 120.59

Parameters

Flag	Short	Description
--file	-f	Path to video or image file (required)
--probe		Only show extracted metadata, don't upload
--time		Start time as epoch milliseconds
--datetime		Start time as readable datetime (e.g. 2025-06-22 14:00:00)
--timezone		Timezone for --datetime (e.g. Asia/Shanghai, UTC, +8)
--lat		Latitude
--lon		Longitude
--location		Location name to geocode (e.g. Suzhou, China)

Workflow

1. Probe first: run with --probe to see what metadata the file has
2. If time and GPS are both present → upload directly
3. If missing (common for images, screenshots), ask the user for the missing info (time and/or location)
4. Upload with all parameters filled in