ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

MuPiBox Media DB

v1.0.2

Manage the MuPiBox media database via backend API to list, add, remove, move, edit, and restore media entries stored in data.json.

⭐ 0· 695·0 current·0 all-time
by@tomquist
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description match the bundled Python script: the script reads /api/data and posts to /api/add,/api/edit,/api/delete on a configurable base URL. No unrelated binaries, env vars, or services are requested.
ℹ
Instruction Scope
SKILL.md and the script confine actions to the MuPiBox API and local backups. The script creates timestamped backups under the user's home (~/.mupibox-db-backups) before mutations and can restore from a user-specified file; these file operations are expected but worth noting (disk writes, potential large backup volume, and restore requires a trusted file).
✓
Install Mechanism
No install spec; the skill is instruction-only with a bundled Python script. Nothing is downloaded or extracted from external URLs, which minimizes install-time risk.
✓
Credentials
The skill requires no environment variables or credentials. It only needs network access to the MuPiBox base URL provided by the user/agent; this is proportional to its API-driven purpose.
✓
Persistence & Privilege
always is false and the skill does not request persistent system-wide privileges or modify other skills. It can be invoked autonomously by the agent (default), which is normal — note this allows the agent to make API mutations if triggered.
Assessment
This skill appears to do exactly what it says: manage a MuPiBox media DB via the MuPiBox backend. Before installing or running it, confirm you actually run (or trust) the MuPiBox service at the base URL you will provide. Be aware the script will create backups under ~/.mupibox-db-backups (ensure you have space and that you trust the backup/restore files). Because the skill can be invoked by the agent, avoid enabling it for autonomous use unless you want the agent to be able to add/edit/delete entries on that backend. If you do not run a MuPiBox instance, there is no need to install this skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk977t2w6b2462ytkgfrc1mew49814tac

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments