跳到主要内容
知仓学习社ZHICANG

muapi-media

Discover current MuAPI image models and run one explicitly confirmed asynchronous image generation request with bounded polling. Use when an agent n…

执行命令读凭据联网严重 1 · 高危 2davepoon/buildwithclaude

它会碰到什么

扫了多少3 个文本文件,18 KB
它会碰到什么执行命令读凭据联网
命中总数9 处
命中统计严重 1 · 高 2 · 中 3 · 低 3
逐条看命中(3 条严重或高危)
  • 严重 SKILL.md:4perm-wildcard
    allowed-tools: Bash(python3 *)
  • scripts/muapi_media.py:85cred-envread
    self.base_url = self._normalize_base_url(base_url or os.environ.get("MUAPI_BASE_URL") or DEFAULT_BASE_URL)
  • scripts/muapi_media.py:86cred-envread
    self.api_key = api_key or os.environ.get("MUAPI_API_KEY", "").strip()

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

MuAPI Media

Use the bundled scripts/muapi_media.py CLI to discover current MuAPI image models and submit

one explicitly confirmed image-generation request. The CLI uses the live catalog's name,

category, and already-versioned endpoint fields, then polls the standard prediction result

endpoint. It does not assume that the catalog contains an inline request schema; add model-specific

fields only from the current model contract.

When to use this skill

  • The user wants to find a current MuAPI image model.
  • An image workflow needs MuAPI's exact model endpoint rather than a remembered alias.
  • The user has explicitly approved a potentially billable image-generation request.
  • An asynchronous MuAPI prediction needs bounded status polling.

This skill covers text-to-image and image-to-image workflows. Do not use it for MuAPI video, audio,

3D, chat, or model-training requests.

Setup

Set the API key in the environment. Never pass it as a CLI argument or commit it:

~~~bash

export MUAPI_API_KEY="your-api-key"

~~~

MUAPI_BASE_URL is optional and defaults to https://api.muapi.ai. Use it only for an approved

compatible deployment.

Workflow

1. Discover current image models

~~~bash

python3 scripts/muapi_media.py models --category image --query flux

~~~

The public catalog currently returns a top-level models array. Image-generation entries use

categories such as Text to Image and Image to Image; their endpoint values already include

the /api/v1/ prefix. Choose an exact model from this output immediately before generation.

2. Prepare and review parameters

~~~json

{

"prompt": "A clean product photograph on a neutral background",

"aspect_ratio": "1:1"

}

~~~

Keep only fields supported by the selected model's current request contract. The catalog is a

model directory, not a guarantee that every model accepts the same parameters. A prompt is required

for this skill.

3. Confirm cost and generate once

~~~bash

python3 scripts/muapi_media.py generate \

flux-dev \

--params-file request.json \

--confirm-paid

~~~

--confirm-paid is mandatory. The CLI sends exactly one generation POST, never retries an

ambiguous POST, and polls only GET requests with a finite budget. The model argument may be the

catalog model name or its exact /api/v1/... endpoint path.

Use --output to download the first completed artifact without sending the API key to the output

host:

~~~bash

python3 scripts/muapi_media.py generate \

flux-dev \

--params-file request.json \

--confirm-paid \

--output ./muapi-output.png

~~~

Safety rules

  • Keep MUAPI_API_KEY server-side and out of logs, prompts, screenshots, and committed files.
  • Never retry a generation POST automatically. Require fresh user confirmation before another paid request.
  • Poll only with GET and stop at --max-polls.
  • Preserve the catalog endpoint path; do not prepend /api/v1/ to an endpoint that already has it.
  • Download only HTTPS output URLs and do not forward the API key to the output host.
  • Require human review for sensitive, regulated, or high-impact content.

Output

Commands write structured JSON to stdout. A successful generation includes the selected model,

request ID, terminal status, output URLs, and—when requested—the local artifact path.

Official references

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 3,470
本站分层T1
该仓技能数381
原文件路径plugins/all-skills/skills/muapi-media/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 381 个技能