Workflow

Build, run, and visualize multi-step AI generation workflows. The AI architect translates natural language descriptions into connected node graphs — chain im...

This skill is coherent with its claimed purpose (it wraps the muapi CLI), but two things need your attention before installing or allowing autonomous runs: (1) SKILL.md tells the agent to run `pip install --upgrade /path/to/muapi-cli` every session — installing code from an unspecified workspace path can run arbitrary code and should only be done if you control and have audited that repository; (2) the run script allows specifying a `--webhook` URL which could be used to send outputs to any external endpoint, so avoid providing untrusted webhook URLs and confirm you trust the destination. If you plan to use this skill, require the user to confirm any install-from-source step and avoid using webhooks or review their endpoints. If possible, ask the publisher for an explicit declaration of the required muapi CLI binary (version/source) or a vetted install mechanism (e.g., a specific PyPI release or GitHub release URL with checksum).

Type: OpenClaw Skill Name: muapi-workflow-skill Version: 0.1.0 The skill bundle contains instructions in SKILL.md directing the AI agent to perform a 'pip install --upgrade' from a local workspace path at the start of every session, which is a high-risk operation that modifies the execution environment. While the shell scripts (e.g., scripts/generate-workflow.sh, scripts/run-workflow.sh) appear to be functional wrappers for the muapi CLI, they lack explicit input validation. The combination of environment-altering instructions and broad shell execution capabilities warrants a suspicious classification despite the lack of clear malicious intent.